\documentclass{article}
\usepackage{czt}

\begin{document}
\begin{zsection}
  \SECTION zTime \parents standard\_toolkit
\end{zsection}

\begin{zed}
  [CONTEXT, TASK]
\end{zed}

\begin{axdef}
  bare\_context: CONTEXT\\
  idle: TASK
\end{axdef}

\begin{zed}
STATE ::= nonexistent | ready | blocked | suspended | running
\end{zed}

\begin[disabled]{zed}
transition == (\{blocked\} \cross  \{nonexistent, ready, running, suspended\}) \cup  (\{nonexistent\} \cross  \{ready, running\}) \cup  (\{ready\} \cross  \{nonexistent, running, suspended\}) \cup  (\{running\} \cross  \{blocked, nonexistent, ready, suspended\}) \cup  (\{suspended\} \cross  \{nonexistent, ready, running\})
\end{zed}

\begin{theorem}{grule gTransitionType}
transition \in  \power  (STATE \cross  STATE)
\end{theorem}

\begin{zproof}[gTransitionType]
with enabled (transition) prove by reduce;
\end{zproof}

\begin{theorem}{rule lInTransition}
\forall  l, r: STATE | (l, r) \in  \{nonexistent \mapsto  ready, running \mapsto  ready, blocked \mapsto  ready, suspended \mapsto  ready, ready \mapsto  running, blocked \mapsto  running, suspended \mapsto  running, nonexistent \mapsto  running, running \mapsto  suspended, ready \mapsto  suspended, blocked \mapsto  suspended, running \mapsto  blocked, running \mapsto  nonexistent, ready \mapsto  nonexistent, blocked \mapsto  nonexistent, suspended \mapsto  nonexistent\} @ (l, r) \in  transition
\end{theorem}

\begin{zproof}[lInTransition]
with normalization with enabled (transition) prove by reduce;
\end{zproof}

\begin{schema}{TaskData}
  tasks: \finset  TASK\\
  running\_task: TASK
\where
  running\_task \in  tasks\\
  idle \in  tasks
\end{schema}

\begin{schema}{Init\_TaskData}
  TaskData~'
\where
  tasks' = \{idle\}\\
  running\_task' = idle
\end{schema}

\begin{theorem}{TaskDataInit}
\exists  TaskData~' @ Init\_TaskData
\end{theorem}

\begin{zproof}[TaskDataInit]
prove by reduce;
\end{zproof}

\begin{schema}{StateData}
  state: TASK \fun  STATE
\where
  state(idle) \in  \{ready, running\}
\end{schema}

\begin{schema}{Init\_StateData}
  StateData~'
\where
  state' = (\lambda  x: TASK @ nonexistent) \oplus  \{(idle \mapsto  running)\}
\end{schema}

\begin{theorem}{StateDataInit}
\exists  StateData~' @ Init\_StateData
\end{theorem}

\begin{zproof}[StateDataInit]
prove by reduce;
\end{zproof}

\begin{schema}{ContextData}
  phys\_context: CONTEXT\\
  log\_context: TASK \fun  CONTEXT
\end{schema}

\begin{schema}{Init\_ContextData}
  ContextData~'
\where
  phys\_context' = bare\_context\\
  log\_context' = (\lambda  x: TASK @ bare\_context)
\end{schema}

\begin{theorem}{ContextDataInit}
\exists  ContextData~' @ Init\_ContextData
\end{theorem}

\begin{zproof}[ContextDataInit]
prove by reduce;
\end{zproof}

\begin{schema}{PrioData}
  priority: TASK \fun  \nat 
\where
  priority(idle) = 0
\end{schema}

\begin{schema}{Init\_PrioData}
  PrioData~'
\where
  priority' = (\lambda  x: TASK @ 0)
\end{schema}

\begin{theorem}{PrioDataInit}
\exists  PrioData~' @ Init\_PrioData
\end{theorem}

\begin{zproof}[PrioDataInit]
prove by reduce;
\end{zproof}

\begin{schema}{Task}
  TaskData\\
  StateData\\
  ContextData\\
  PrioData
\where
  tasks = TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg )\\
  state \inv  \limg  \{running\} \rimg  = \{running\_task\}\\
  \forall  pt: state \inv  \limg  \{ready\} \rimg  @ priority(running\_task) \geq  priority(pt)
\end{schema}

\begin{schema}{\Delta Task}
  Task\\
  Task~'
\where
  \forall  st: TASK | state'(st) \neq  state(st) @ state(st) \mapsto  state'(st) \in  transition
\end{schema}

\begin{axdef}
  f: \power  TASK \fun  TASK
\where
  \Label{findDelegate}
  \forall  Task; a: \power  TASK; g: TASK \pfun \num @ \\
  f(a) \in  a \land a \subseteq \dom g \land\\
  (\forall  t: a @ g (f(a)) \geq  g (t))
\end{axdef}

\begin{zproof}[f\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{TaskProperty1}
\forall  Task @ state(running\_task) = running
\end{theorem}

\begin{zproof}[TaskProperty1]
invoke Task;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
rewrite;
\end{zproof}

\begin{theorem}{TaskProperty2}
\forall  Task @ \forall  t: TASK | t \in  state \inv  \limg  \{blocked\} \rimg  @ t \in  tasks
\end{theorem}

\begin{zproof}[TaskProperty2]
invoke Task;
prove;
\end{zproof}

\begin{theorem}{TaskProperty3}
\forall  Task @ \forall  t: state \inv  \limg  \{ready\} \rimg  @ t \in  tasks \setminus  \{running\_task\}
\end{theorem}

\begin{zproof}[TaskProperty3]
invoke Task;
prove;
\end{zproof}

\begin{theorem}{TaskProperty6}
\forall  Task; t: TASK | 0 < priority(t) @ idle \neq  t
\end{theorem}

\begin{zproof}[TaskProperty6]
prove by reduce;
\end{zproof}

\begin{schema}{Init\_Task}
  Task~'
\where
  Init\_TaskData\\
  Init\_StateData\\
  Init\_ContextData\\
  Init\_PrioData
\end{schema}

\begin{theorem}{TaskInit}
\exists  Task~' @ Init\_Task
\end{theorem}

\begin{zproof}[TaskInit]
prove by reduce;
apply extensionality;
prove;
apply applyOverride1;
prove;
\end{zproof}

\begin{schema}{Reschedule}
  \Delta Task\\
  target?: TASK\\
  tasks?: \finset  TASK\\
  st?: STATE\\
  pri?: TASK \fun  \nat 
\where
  tasks' = tasks?\\
  running\_task' = target?\\
  state' = state \oplus  \{(target? \mapsto  running), (running\_task \mapsto  st?)\}\\
  phys\_context' = log\_context(target?)\\
  log\_context' = log\_context \oplus  \{(running\_task \mapsto  phys\_context)\}\\
  priority' = pri?
\end{schema}

\begin{zed}
disableReschedule \defs [Task | false] \land  Reschedule
\end{zed}

\begin{schema}{CreateTaskN\_T}
  \Delta Task\\
  target?: TASK\\
  newpri?: \nat 
\where
  state(target?) = nonexistent\\
  newpri? \leq  priority(running\_task)\\
  tasks' = tasks \cup  \{target?\}\\
  running\_task' = running\_task\\
  state' = state \oplus  \{(target? \mapsto  ready)\}\\
  \Xi ContextData\\
  priority' = priority \oplus  \{(target? \mapsto  newpri?)\}
\end{schema}

\begin{schema}{CreateTaskN\_TFSBSig}
  Task\\
  target?: TASK\\
  newpri?: \nat 
\where
  state(target?) = nonexistent\\
  newpri? \leq  priority(running\_task)
\end{schema}

\begin{theorem}{rule runningUpdate}
\forall  f: TASK \fun  STATE; g: TASK \pfun  STATE | running \notin  \ran  g \land  (f \inv  \limg  \{running\} \rimg ) \cap  \dom  g = \emptyset @ (f \oplus  g) \inv  \limg  \{running\} \rimg  = f \inv  \limg  \{running\} \rimg 
\end{theorem}

\begin{zproof}[runningUpdate]
apply extensionality to predicate (f \oplus  g) \inv  \limg  \{running\} \rimg  = f \inv  \limg  \{running\} \rimg ;
prove;
cases;
split x \in  \dom  g;
prove;
use applyInRanPfun[TASK, STATE][A := TASK, B := STATE, f := g, a := x];
prove;
next;
apply applyOverride to expression (f \oplus  g) y;
prove;
apply extensionality to predicate \dom  g \cap  (f \inv  \limg  \{running\} \rimg ) = \{\};
prove;
instantiate x == y;
prove;
next;
\end{zproof}

\begin{theorem}{rule setminUpdate}
\forall  f: TASK \fun  STATE; g: TASK \pfun  STATE @ TASK \setminus  ((f \oplus  g) \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  (f \inv  \limg  \{nonexistent\} \rimg ) \setminus  (g \inv  \limg  \{nonexistent\} \rimg ) \cup  (\dom  g \setminus  (g \inv  \limg  \{nonexistent\} \rimg ))
\end{theorem}

\begin{zproof}[setminUpdate]
apply extensionality to predicate TASK \setminus  ((f \oplus  g) \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  (f \inv  \limg  \{nonexistent\} \rimg ) \setminus  (g \inv  \limg  \{nonexistent\} \rimg ) \cup  (\dom  g \setminus  (g \inv  \limg  \{nonexistent\} \rimg ));
prove;
with normalization reduce;
split x \in  \dom  g;
prove;
\end{zproof}

\begin{theorem}{CreateTaskN\_T\_vc\_ref}
\forall  CreateTaskN\_TFSBSig | true @ \pre  CreateTaskN\_T
\end{theorem}

\begin{zproof}[CreateTaskN\_T\_vc\_ref]
with disabled (ContextData) prove by reduce;
instantiate pt\_\_0 == pt;
with enabled (applyOverride) prove;
apply applyOverride;
with normalization reduce;
\end{zproof}

\begin{schema}{CreateTaskS\_T}
  \Delta Task\\
  target?: TASK\\
  newpri?: \nat 
\where
  state(target?) = nonexistent\\
  newpri? > priority(running\_task)\\
  \exists  st?: STATE; tasks?: \finset  TASK; pri?: TASK \fun  \nat  | st? = ready \land  tasks? = tasks \cup  \{target?\} \land  pri? = priority \oplus  \{(target? \mapsto  newpri?)\} @ Reschedule
\end{schema}

\begin{schema}{CreateTaskS\_TFSBSig}
  Task\\
  target?: TASK\\
  newpri?: \nat 
\where
  state(target?) = nonexistent\\
  newpri? > priority(running\_task)
\end{schema}

\begin{theorem}{CreateTaskS\_T\_vc\_ref}
\forall  CreateTaskS\_TFSBSig | true @ \pre  CreateTaskS\_T
\end{theorem}

\begin{zproof}[CreateTaskS\_T\_vc\_ref]
prove by reduce;
apply applyOverride to expression (state \oplus  (\{(running\_task, ready)\} \cup  \{(target?, running)\})) idle;
prove;
cases;
apply extensionality to predicate (state \oplus  (\{(running\_task, ready)\} \cup  \{(target?, running)\})) \inv  \limg  \{running\} \rimg  = \{target?\};
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
prove;
instantiate x\_\_0 == x;
prove;
apply applyOverride;
prove;
split x \in  TASK;
split x = running\_task;
prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) \cup  ((state \inv  \limg  \{running\} \rimg ) \cup  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(target?, running)\})) \inv  \limg  \{running\} \rimg )) = TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) \cup  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(target?, running)\})) \inv  \limg  \{running\} \rimg );
prove;
apply applyOverride;
prove;
next;
apply applyOverride;
prove;
split pt = running\_task;
prove;
instantiate pt\_\_0 == pt;
prove;
next;
apply applyOverride;
prove;
with normalization prove;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
instantiate y == st;
prove;
next;
\end{zproof}

\begin{zed}
CreateTask\_T \defs CreateTaskN\_T \lor  CreateTaskS\_T
\end{zed}

\begin{schema}{DeleteTaskN\_T}
  \Delta Task\\
  target?: TASK\\
  topReady!: TASK
\where
  target? \in  tasks \setminus  \{idle\}\\
  state(target?) \in  \{ready, blocked, suspended\}\\
  tasks' = tasks \setminus  \{target?\}\\
  running\_task' = running\_task\\
  state' = state \oplus  \{(target? \mapsto  nonexistent)\}\\
  phys\_context' = phys\_context\\
  log\_context' = log\_context \oplus  \{(target? \mapsto  bare\_context)\}\\
  \Xi PrioData\\
  topReady! = running\_task
\end{schema}

\begin{schema}{DeleteTaskN\_TFSBSig}
  Task\\
  target?: TASK
\where
  target? \in  tasks \setminus  \{idle\}\\
  state(target?) \in  \{ready, blocked, suspended\}
\end{schema}

\begin{theorem}{finsetIsFinset}
\forall  X: \finset  TASK; x: TASK @ X \setminus  \{x\} \in  \finset  TASK
\end{theorem}

\begin{zproof}[finsetIsFinset]
prove;
\end{zproof}

\begin{theorem}{DeleteTaskN\_T\_vc\_ref}
\forall  DeleteTaskN\_TFSBSig | true @ \pre  DeleteTaskN\_T
\end{theorem}

\begin{zproof}[DeleteTaskN\_T\_vc\_ref]
prove by reduce;
use finsetIsFinset[X := TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ), x := target?];
prove;
apply extensionality to predicate (state \oplus  \{(target?, nonexistent)\}) \inv  \limg  \{running\} \rimg  = state \inv  \limg  \{running\} \rimg ;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
prove;
apply applyOverride;
instantiate pt\_\_0 == pt;
split state(target?) = ready;
prove;
split state(target?) = blocked;
prove;
\end{zproof}

\begin{schema}{DeleteTaskS\_T}
  \Delta Task\\
  target?: TASK\\
  topReady!: TASK
\where
  target? \in  tasks \setminus  \{idle\}\\
  state(target?) \in  \{running\}\\
  state(topReady!) = ready\\
  \forall  t: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(t)\\
  tasks' = tasks \setminus  \{target?\}\\
  running\_task' = topReady!\\
  state' = state \oplus  \{(topReady! \mapsto  running), (target? \mapsto  nonexistent)\}\\
  phys\_context' = log\_context(topReady!)\\
  log\_context' = log\_context \oplus  \{(target? \mapsto  bare\_context)\}\\
  \Xi PrioData
\end{schema}

\begin{schema}{DeleteTaskS\_TFSBSig}
  Task\\
  target?: TASK
\where
  target? \in  tasks \setminus  \{idle\}\\
  state(target?) \in  \{running\}
\end{schema}

\begin{theorem}{lDeleteTaskS\_T\_Lemma}
\forall  Task; topReady!, target?: TASK | target? \in  tasks \setminus  \{idle\} \land  state(target?) \in  \{running\} \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (Task[log\_context := log\_context \oplus  \{(target?, bare\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\}), tasks := tasks \setminus  \{target?\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\}))(st) = state(st) \implies  (state(st), (state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\}))(st)) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lDeleteTaskS\_T\_Lemma]
prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate TASK \setminus  (\{target?\} \cup  (state \inv  \limg  \{nonexistent\} \rimg )) = \{topReady!\} \cup  (TASK \setminus  (\{target?\} \cup  (state \inv  \limg  \{nonexistent\} \rimg )));
apply extensionality to predicate (state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
with enabled (applyOverride) prove;
instantiate x == target?;
cases;
with normalization prove;
next;
instantiate x\_\_0 == x;
with enabled (applyOverride) with normalization prove;
next;
split state(idle) = running;
prove;
next;
instantiate rtsk == pt;
with enabled (applyOverride) with normalization prove;
next;
split st = target?;
prove;
next;
instantiate rtsk == t;
prove;
next;
\end{zproof}

\begin{theorem}{DeleteTaskS\_T\_vc\_ref}
\forall  DeleteTaskS\_TFSBSig | true @ \pre  DeleteTaskS\_T
\end{theorem}

\begin{zproof}[DeleteTaskS\_T\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg, g := priority ];
with disabled (Task) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lDeleteTaskS\_T\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
\end{zproof}

\begin{zed}
DeleteTask\_T \defs DeleteTaskN\_T \lor  DeleteTaskS\_T
\end{zed}

\begin{schema}{ExecuteRunningTask\_T}
  \Delta Task\\
  target!: TASK
\where
  \Xi TaskData\\
  \Xi StateData\\
  phys\_context' \neq  phys\_context\\
  log\_context' = log\_context\\
  \Xi PrioData\\
  target! = running\_task
\end{schema}

\begin{schema}{ExecuteRunningTask\_TFSBSig}
  Task
\where
  \exists  phys\_context': CONTEXT @ phys\_context' \neq  phys\_context
\end{schema}

\begin{theorem}{ExecuteRunningTask\_T\_vc\_ref}
\forall  ExecuteRunningTask\_TFSBSig | true @ \pre  ExecuteRunningTask\_T
\end{theorem}

\begin{zproof}[ExecuteRunningTask\_T\_vc\_ref]
with disabled (TaskData, StateData, PrioData) prove by reduce;
\end{zproof}

\begin{schema}{SuspendTaskN\_T}
  \Delta Task\\
  target?: TASK\\
  topReady!: TASK
\where
  target? \in  tasks \setminus  \{idle\}\\
  state(target?) \in  \{ready, blocked\}\\
  \Xi TaskData\\
  state' = state \oplus  \{(target? \mapsto  suspended)\}\\
  \Xi ContextData\\
  \Xi PrioData\\
  topReady! = running\_task
\end{schema}

\begin{schema}{SuspendTaskN\_TFSBSig}
  Task\\
  target?: TASK
\where
  target? \in  tasks \setminus  \{idle\}\\
  state(target?) \in  \{ready, blocked\}
\end{schema}

\begin{theorem}{SuspendTaskN\_T\_vc\_ref}
\forall  SuspendTaskN\_TFSBSig | true @ \pre  SuspendTaskN\_T
\end{theorem}

\begin{zproof}[SuspendTaskN\_T\_vc\_ref]
prove by reduce;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{target?\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ));
instantiate pt\_\_0 == pt;
prove;
apply applyOverride;
prove;
cases;
with normalization prove;
next;
with normalization prove;
next;
with normalization prove;
next;
with normalization prove;
next;
\end{zproof}

\begin{schema}{SuspendTaskS\_T}
  \Delta Task\\
  target?: TASK\\
  topReady!: TASK
\where
  target? \in  tasks \setminus  \{idle\}\\
  state(target?) \in  \{running\}\\
  state(topReady!) = ready\\
  \forall  t: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(t)\\
  \exists  st?: STATE | st? = suspended @ Reschedule[tasks/tasks?, priority/pri?, topReady!/target?]
\end{schema}

\begin{theorem}{TaskProperty4}
\forall  Task | SuspendTaskS\_T @ state'(running\_task) = suspended \land  (\forall  t: state \inv  \limg  \{ready\} \rimg  @ priority(running\_task') \geq  priority(t))
\end{theorem}

\begin{zproof}[TaskProperty4]
with disabled (\Delta Task, Task) prove by reduce;
use TaskProperty3[t := topReady!];
instantiate t\_\_0 == t;
prove;
\end{zproof}

\begin{theorem}{TaskProperty5}
\forall  Task @ \forall  t: TASK | t \notin  tasks @ state(t) = nonexistent
\end{theorem}

\begin{zproof}[TaskProperty5]
prove by reduce;
\end{zproof}

\begin{schema}{SuspendTaskS\_TFSBSig}
  Task\\
  target?: TASK
\where
  target? \in  tasks \setminus  \{idle\}\\
  state(target?) \in  \{running\}
\end{schema}

\begin{theorem}{lSuspendTaskS\_T\_Lemma}
\forall  Task; target?, topReady!: TASK | target? \in  tasks \setminus  \{idle\} \land  state(target?) \in  \{running\} \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (Task[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lSuspendTaskS\_T\_Lemma]
prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  ((state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{nonexistent\} \rimg );
apply extensionality to predicate (state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
with enabled (applyOverride) prove;
instantiate x == target?;
cases;
with normalization prove;
next;
instantiate x\_\_0 == x;
with enabled (applyOverride) with normalization prove;
next;
with normalization prove;
next;
instantiate rtsk == pt;
with normalization prove;
next;
split st = running\_task;
prove;
next;
instantiate rtsk == t;
prove;
next;
\end{zproof}

\begin{theorem}{SuspendTaskS\_T\_vc\_ref}
\forall  SuspendTaskS\_TFSBSig | true @ \pre  SuspendTaskS\_T
\end{theorem}

\begin{zproof}[SuspendTaskS\_T\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg, g := priority ];
with disabled (Task) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lSuspendTaskS\_T\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
\end{zproof}

\begin{schema}{SuspendTaskO\_T}
  \Xi Task\\
  target?: TASK\\
  topReady!: TASK
\where
  state(target?) \in  \{suspended\}\\
  topReady! = running\_task
\end{schema}

\begin{schema}{SuspendTaskO\_TFSBSig}
  Task\\
  target?: TASK\\
  topReady!: TASK
\where
  state(target?) \in  \{suspended\}
\end{schema}

\begin{theorem}{SuspendTaskO\_T\_vc\_ref}
\forall  SuspendTaskO\_TFSBSig | true @ \pre  SuspendTaskO\_T
\end{theorem}

\begin{zproof}[SuspendTaskO\_T\_vc\_ref]
prove by reduce;
\end{zproof}

\begin{zed}
SuspendTask\_T \defs SuspendTaskN\_T \lor  SuspendTaskS\_T \lor  SuspendTaskO\_T
\end{zed}

\begin{schema}{ResumeTaskN\_T}
  \Delta Task\\
  target?: TASK
\where
  state(target?) = suspended\\
  priority(target?) \leq  priority(running\_task)\\
  \Xi TaskData\\
  state' = state \oplus  \{(target? \mapsto  ready)\}\\
  \Xi ContextData\\
  \Xi PrioData
\end{schema}

\begin{schema}{ResumeTaskN\_TFSBSig}
  Task\\
  target?: TASK
\where
  state(target?) = suspended\\
  priority(target?) \leq  priority(running\_task)
\end{schema}

\begin{theorem}{ResumeTaskN\_T\_vc\_ref}
\forall  ResumeTaskN\_TFSBSig | true @ \pre  ResumeTaskN\_T
\end{theorem}

\begin{zproof}[ResumeTaskN\_T\_vc\_ref]
prove by reduce;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{target?\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ));
with enabled (applyOverride) prove;
apply applyOverride;
instantiate pt\_\_0 == pt;
with normalization prove;
\end{zproof}

\begin{schema}{ResumeTaskS\_T}
  \Delta Task\\
  target?: TASK
\where
  state(target?) = suspended\\
  priority(target?) > priority(running\_task)\\
  \exists  st?: STATE | st? = ready @ Reschedule[tasks/tasks?, priority/pri?]
\end{schema}

\begin{schema}{ResumeTaskS\_TFSBSig}
  Task\\
  target?: TASK
\where
  state(target?) = suspended\\
  priority(target?) > priority(running\_task)
\end{schema}

\begin{theorem}{ResumeTaskS\_T\_vc\_ref}
\forall  ResumeTaskS\_TFSBSig | true @ \pre  ResumeTaskS\_T
\end{theorem}

\begin{zproof}[ResumeTaskS\_T\_vc\_ref]
prove by reduce;
apply extensionality to predicate \{target?\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) \cup  (state \inv  \limg  \{running\} \rimg )) = TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg );
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate (state \oplus  (\{(running\_task, ready)\} \cup  \{(target?, running)\})) \inv  \limg  \{running\} \rimg  = \{target?\};
prove;
apply applyOverride;
instantiate x\_\_1 == x\_\_0;
instantiate pt\_\_0 == pt;
cases;
with normalization prove;
next;
with normalization prove;
next;
with normalization prove;
next;
with normalization prove;
next;
with normalization prove;
next;
with normalization prove;
next;
\end{zproof}

\begin{zed}
ResumeTask\_T \defs ResumeTaskN\_T \lor  ResumeTaskS\_T
\end{zed}

\begin{schema}{ChangeTaskPriorityN\_T}
  \Delta Task\\
  newpri?: \nat \\
  target?: TASK\\
  topReady!: TASK
\where
  state(target?) = ready \implies  newpri? \leq  priority(running\_task)\\
  state(target?) = running \implies  (\forall  t: state \inv  \limg  \{ready\} \rimg  @ newpri? \geq  priority(t))\\
  state(target?) \neq  nonexistent\\
  target? = idle \implies  newpri? = 0\\
  \Xi TaskData\\
  \Xi StateData\\
  \Xi ContextData\\
  priority' = priority \oplus  \{(target? \mapsto  newpri?)\}\\
  topReady! = running\_task
\end{schema}

\begin{schema}{ChangeTaskPriorityN\_TFSBSig}
  Task\\
  newpri?: \nat \\
  target?: TASK
\where
  state(target?) = ready \implies  newpri? \leq  priority(running\_task)\\
  state(target?) = running \implies  (\forall  t: state \inv  \limg  \{ready\} \rimg  @ newpri? \geq  priority(t))\\
  state(target?) \neq  nonexistent\\
  target? = idle \implies  newpri? = 0
\end{schema}

\begin{theorem}{ChangeTaskPriorityN\_T\_vc\_ref}
\forall  ChangeTaskPriorityN\_TFSBSig | true @ \pre  ChangeTaskPriorityN\_T
\end{theorem}

\begin{zproof}[ChangeTaskPriorityN\_T\_vc\_ref]
with enabled (applyOverride) prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
instantiate t == pt;
with normalization prove;
\end{zproof}

\begin{schema}{ChangeTaskPriorityS\_T}
  \Delta Task\\
  target?: TASK\\
  newpri?: \nat \\
  topReady!: TASK
\where
  state(target?) = ready\\
  newpri? > priority(running\_task)\\
  target? = idle \implies  newpri? = 0\\
  \exists  st?: STATE; pri?: TASK \fun  \nat  | st? = ready \land  pri? = priority \oplus  \{(target? \mapsto  newpri?)\} @ Reschedule[tasks/tasks?]\\
  topReady! = target?
\end{schema}

\begin{schema}{ChangeTaskPriorityS\_TFSBSig}
  Task\\
  newpri?: \nat \\
  target?: TASK
\where
  state(target?) = ready\\
  newpri? > priority(running\_task)\\
  target? = idle \implies  newpri? = 0
\end{schema}

\begin{theorem}{ChangeTaskPriorityS\_T\_vc\_ref}
\forall  ChangeTaskPriorityS\_TFSBSig | true @ \pre  ChangeTaskPriorityS\_T
\end{theorem}

\begin{zproof}[ChangeTaskPriorityS\_T\_vc\_ref]
prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate TASK \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(target?, running)\})) \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg );
apply extensionality to predicate (state \oplus  (\{(running\_task, ready)\} \cup  \{(target?, running)\})) \inv  \limg  \{running\} \rimg  = \{target?\};
prove;
with enabled (applyOverride) prove;
apply applyOverride;
apply applyCupRight;
apply applyCupLeft;
prove;
instantiate x\_\_1 == x\_\_0;
instantiate pt\_\_0 == pt;
cases;
with normalization reduce;
next;
with normalization reduce;
next;
with normalization reduce;
next;
with normalization reduce;
next;
\end{zproof}

\begin{schema}{ChangeTaskPriorityD\_T}
  \Delta Task\\
  target?: TASK\\
  topReady!: TASK\\
  newpri?: \nat 
\where
  state(target?) = running\\
  target? = idle \implies  newpri? = 0\\
  state(topReady!) = ready\\
  \forall  t: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(t)\\
  newpri? < priority(topReady!)\\
  \exists  st?: STATE; pri?: TASK \fun  \nat  | st? = ready \land  pri? = priority \oplus  \{(target? \mapsto  newpri?)\} @ Reschedule[tasks/tasks?, topReady!/target?]
\end{schema}

\begin{schema}{ChangeTaskPriorityD\_TFSBSig}
  Task\\
  newpri?: \nat \\
  target?: TASK
\where
  state(target?) = running\\
  target? = idle \implies  newpri? = 0\\
  \exists  readyTask: state \inv  \limg  \{ready\} \rimg  @ newpri? < priority(readyTask)
\end{schema}

\begin{theorem}{lChangeTaskPriorityD\_T\_Lemma}
\forall  Task; target?, topReady!: TASK; newpri?: \nat  | state(target?) = running \land  (target? = idle \implies  newpri? = 0) \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  newpri? < priority(topReady!) @ \lnot  (Task[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), priority := priority \oplus  \{(target?, newpri?)\}, running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lChangeTaskPriorityD\_T\_Lemma]
prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{nonexistent\} \rimg );
apply extensionality to predicate (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
with enabled (applyOverride) prove;
instantiate x == target?;
cases;
with normalization reduce;
next;
instantiate x\_\_0 == x;
with enabled (applyOverride) with normalization prove;
next;
with normalization reduce;
next;
instantiate rtsk == pt;
with normalization reduce;
next;
with normalization reduce;
next;
instantiate rtsk == t;
prove;
next;
\end{zproof}

\begin{theorem}{ChangeTaskPriorityD\_T\_vc\_ref}
\forall  ChangeTaskPriorityD\_TFSBSig | true @ \pre  ChangeTaskPriorityD\_T
\end{theorem}

\begin{zproof}[ChangeTaskPriorityD\_T\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg, g := priority ];
with disabled (Task) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lChangeTaskPriorityD\_T\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == readyTask;
instantiate t\_\_0 == rtsk;
instantiate t\_\_0 == t;
prove;
\end{zproof}

\begin{zed}
ChangeTaskPriority\_T \defs ChangeTaskPriorityN\_T \lor  ChangeTaskPriorityS\_T \lor  ChangeTaskPriorityD\_T
\end{zed}

\begin{theorem}{CaseStudyStep1}
\forall  Task; target?: TASK; newpri?: \nat  | tasks = \{idle\} \land  running\_task = idle \land  newpri? = 1 \land  CreateTask\_T @ target? \in  tasks' \land  state'(target?) = running \land  priority'(target?) = 1
\end{theorem}

\begin{zproof}[CaseStudyStep1]
with disabled (CreateTaskS\_T, StateData, TaskData, ContextData) reduce;
prove by reduce;
\end{zproof}

\begin{theorem}{CaseStudyStep3}
\forall  Task; target?: TASK; newpri?: \nat  | tasks = \{idle, Task1, Task2\} \land  priority(Task1) = 1 \land  priority(Task2) = 2 \land  state(Task1) = ready \land  running\_task = Task2 \land  target? = Task1 \land  newpri? = 3 \land  ChangeTaskPriority\_T @ priority'(Task1) = 3 \land  running\_task' = Task1
\end{theorem}

\begin{zproof}[CaseStudyStep3]
with disabled (Task, ChangeTaskPriorityS\_T) prove by reduce;
prove by reduce;
\end{zproof}

\begin{theorem}{CaseStudyStep5}
\forall  Task; Task1, Task2, Task3, target?: TASK | tasks = \{idle, Task1, Task2, Task3\} \land  priority(Task1) = 3 \land  priority(Task2) = 2 \land  priority(Task3) = 4 \land  state(Task1) = ready \land  state(Task2) = ready \land  state(Task3) = running \land  target? = Task3 \land  DeleteTask\_T @ state'(Task3) = nonexistent \land  Task3 \notin  tasks' \land  running\_task' = Task1
\end{theorem}

\begin{zproof}[CaseStudyStep5]
with disabled (Task, DeleteTaskS\_T) reduce;
invoke Task;
invoke DeleteTaskS\_T;
apply extensionality to predicate tasks = TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg );
instantiate y == topReady!;
instantiate t == Task1;
invoke PrioData;
split topReady! = idle;
prove;
\end{zproof}

\begin{zed}
  [QUEUE]
\end{zed}

\begin{schema}{QueueData}
  queue: \power  QUEUE\\
  q\_max: QUEUE \pfun  \nat _1{}\\
  q\_size: QUEUE \pfun  \nat 
\where
  \dom  q\_max = \dom  q\_size\\
  \dom  q\_size = queue\\
  \forall  q: QUEUE | q \in  queue @ q\_size(q) \leq  q\_max(q)
\end{schema}

\begin{zproof}[QueueData\$domainCheck]
prove;
\end{zproof}

\begin{schema}{Init\_QueueData}
  QueueData~'
\where
  queue' = \emptyset\\
  q\_max' = \emptyset\\
  q\_size' = \emptyset
\end{schema}

\begin{theorem}{QueueDataInit}
\exists  QueueData~' @ Init\_QueueData
\end{theorem}

\begin{zproof}[QueueDataInit]
prove by reduce;
\end{zproof}

\begin{schema}{WaitingData}
  wait\_snd: TASK \pfun  QUEUE\\
  wait\_rcv: TASK \pfun  QUEUE
\where
  \dom  wait\_snd \cap  \dom  wait\_rcv = \emptyset
\end{schema}

\begin{schema}{Init\_WaitingData}
  WaitingData~'
\where
  wait\_snd' = \emptyset\\
  wait\_rcv' = \emptyset
\end{schema}

\begin{theorem}{WaitingDataInit}
\exists  WaitingData~' @ Init\_WaitingData
\end{theorem}

\begin{zproof}[WaitingDataInit]
prove by reduce;
\end{zproof}

\begin{schema}{QReleasingData}
  release\_snd: TASK \pfun  QUEUE\\
  release\_rcv: TASK \pfun  QUEUE
\where
  \dom  release\_snd \cap  \dom  release\_rcv = \emptyset
\end{schema}

\begin{schema}{Init\_QReleasingData}
  QReleasingData~'
\where
  release\_snd' = \emptyset\\
  release\_rcv' = \emptyset
\end{schema}

\begin{theorem}{QReleasingDataInit}
\exists  QReleasingData~' @ Init\_QReleasingData
\end{theorem}

\begin{zproof}[QReleasingDataInit]
prove by reduce;
\end{zproof}

\begin{schema}{Queue}
  QueueData\\
  WaitingData\\
  QReleasingData
\where
  \ran  wait\_snd \subseteq  queue\\
  \ran  wait\_rcv \subseteq  queue\\
  \ran  release\_snd \subseteq  queue\\
  \ran  release\_rcv \subseteq  queue\\
  (\dom  wait\_snd \cup  \dom  wait\_rcv) \cap  (\dom  release\_snd \cup  \dom  release\_rcv) = \emptyset
\end{schema}

\begin{theorem}{QueueProperty1}
\forall  Queue @ \forall  q: queue @ q\_max(q) > 0
\end{theorem}

\begin{zproof}[QueueProperty1]
prove by reduce;
use applyInRanPfun[QUEUE, \num ][A := QUEUE, B := \nat _1{}, f := q\_max, a := q];
prove;
\end{zproof}

\begin{theorem}{ImageProperty1}
\forall  f: TASK \pfun  QUEUE @ \forall  y: QUEUE @ f \inv  \limg  \{y\} \rimg  \neq  \emptyset \iff  y \in  \ran  f
\end{theorem}

\begin{zproof}[ImageProperty1]
prove;
apply extensionality to predicate f \inv  \limg  \{y\} \rimg  = \{\};
apply inRanFunction to predicate y \in  \ran  f;
cases;
prove;
instantiate x\_\_0 == x;
prove;
next;
prove;
instantiate x\_\_0 == x;
prove;
next;
\end{zproof}

\begin{schema}{Init\_Queue}
  Queue~'
\where
  Init\_QueueData\\
  Init\_WaitingData\\
  Init\_QReleasingData
\end{schema}

\begin{theorem}{QueueInit}
\exists  Queue~' @ Init\_Queue
\end{theorem}

\begin{zproof}[QueueInit]
prove by reduce;
\end{zproof}

\begin{schema}{TaskQueue}
  Task\\
  Queue
\where
  \dom  wait\_snd \subseteq  state \inv  \limg  \{blocked\} \rimg \\
  \dom  wait\_rcv \subseteq  state \inv  \limg  \{blocked\} \rimg 
\end{schema}

\begin{schema}{Init\_TaskQueue}
  TaskQueue~'
\where
  Init\_Task\\
  Init\_Queue
\end{schema}

\begin{theorem}{TaskQueueInit}
\exists  TaskQueue~' @ Init\_TaskQueue
\end{theorem}

\begin{zproof}[TaskQueueInit]
use TaskInit;
prove by reduce;
\end{zproof}

\begin{zed}
\Delta TaskQueue \defs TaskQueue \land  TaskQueue~' \land  \Delta Task
\end{zed}

\begin{schema}{ExtendTaskXi}
  \Delta TaskQueue
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  \Xi Queue
\end{schema}

\begin{schema}{ExtTaskFSBSig}
  TaskQueue
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv
\end{schema}

\begin{zed}
CreateTaskN\_TQ \defs ExtendTaskXi \land  CreateTaskN\_T
\end{zed}

\begin{zed}
CreateTaskN\_TQFSBSig \defs ExtTaskFSBSig \land  CreateTaskN\_TFSBSig
\end{zed}

\begin{theorem}{CreateTaskN\_TQ\_vc\_ref}
\forall  CreateTaskN\_TQFSBSig | true @ \pre  CreateTaskN\_TQ
\end{theorem}

\begin{zproof}[CreateTaskN\_TQ\_vc\_ref]
use CreateTaskN\_T\_vc\_ref;
prove by reduce;
instantiate st\_\_0 == st;
prove;
apply inPower;
prove;
instantiate e\_\_5 == e;
instantiate e\_\_6 == e\_\_0;
apply applyOverride;
prove;
split pt \in  TASK;
prove;
instantiate pt\_\_1 == pt;
prove;
\end{zproof}

\begin{zed}
CreateTaskS\_TQ \defs ExtendTaskXi \land  CreateTaskS\_T
\end{zed}

\begin{zed}
CreateTaskS\_TQFSBSig \defs ExtTaskFSBSig \land  CreateTaskS\_TFSBSig
\end{zed}

\begin{theorem}{CreateTaskS\_TQ\_vc\_ref}
\forall  CreateTaskS\_TQFSBSig | true @ \pre  CreateTaskS\_TQ
\end{theorem}

\begin{zproof}[CreateTaskS\_TQ\_vc\_ref]
use CreateTaskS\_T\_vc\_ref;
prove by reduce;
instantiate st\_\_0 == st;
prove;
apply inPower;
prove;
instantiate e\_\_5 == e;
instantiate e\_\_6 == e\_\_0;
apply applyOverride;
prove;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
cases;
prove;
next;
prove;
next;
instantiate pt\_\_0 == pt;
split state(pt) = ready;
prove;
next;
\end{zproof}

\begin{zed}
CreateTask\_TQ \defs CreateTaskN\_TQ \lor  CreateTaskS\_TQ
\end{zed}

\begin{schema}{DeleteTaskN\_TQ}
  DeleteTaskN\_T\\
  \Delta TaskQueue
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  \Xi QueueData\\
  wait\_snd' = \{target?\} \ndres  wait\_snd\\
  wait\_rcv' = \{target?\} \ndres  wait\_rcv\\
  release\_snd' = \{target?\} \ndres  release\_snd\\
  release\_rcv' = \{target?\} \ndres  release\_rcv
\end{schema}

\begin{zed}
DeleteTaskN\_TQFSBSig \defs ExtTaskFSBSig \land  DeleteTaskN\_TFSBSig
\end{zed}

\begin{theorem}{DeleteTaskN\_TQ\_vc\_ref}
\forall  DeleteTaskN\_TQFSBSig | true @ \pre  DeleteTaskN\_TQ
\end{theorem}

\begin{zproof}[DeleteTaskN\_TQ\_vc\_ref]
use DeleteTaskN\_T\_vc\_ref;
prove by reduce;
instantiate st\_\_0 == st;
prove;
apply extensionality to predicate (\dom  wait\_rcv \setminus  \{target?\}) \cap  (\dom  wait\_snd \setminus  \{target?\}) = \{\};
apply extensionality to predicate (\dom  release\_rcv \setminus  \{target?\}) \cap  (\dom  release\_snd \setminus  \{target?\}) = \{\};
apply extensionality to predicate (\dom  release\_rcv \setminus  \{target?\} \cup  (\dom  release\_snd \setminus  \{target?\})) \cap  (\dom  wait\_rcv \setminus  \{target?\} \cup  (\dom  wait\_snd \setminus  \{target?\})) = \{\};
prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_2 == x;
instantiate x\_\_3 == x\_\_0;
instantiate x\_\_4 == x\_\_1;
prove;
apply inPower;
prove;
instantiate e\_\_5 == e;
instantiate e\_\_6 == e\_\_0;
instantiate e\_\_7 == e\_\_1;
instantiate e\_\_8 == e\_\_2;
instantiate e\_\_9 == e\_\_3;
instantiate e\_\_10 == e\_\_4;
apply inRan;
prove;
instantiate x\_\_9 == x\_\_2;
instantiate x\_\_10 == x\_\_3;
instantiate x\_\_11 == x\_\_4;
instantiate x\_\_12 == x\_\_5;
apply applyOverride;
instantiate pt\_\_0 == pt;
split x\_\_5 = target?;
prove;
\end{zproof}

\begin{zed}
DeleteTaskS\_TQ \defs ExtendTaskXi \land  DeleteTaskS\_T
\end{zed}

\begin{zed}
DeleteTaskS\_TQFSBSig \defs ExtTaskFSBSig \land  DeleteTaskS\_TFSBSig
\end{zed}

\begin{theorem}{lDeleteTaskS\_TQ\_Lemma}
\forall  TaskQueue; topReady!, target?: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  target? \in  tasks \setminus  \{idle\} \land  state(target?) \in  \{running\} \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (TaskQueue[log\_context := log\_context \oplus  \{(target?, bare\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\}), tasks := tasks \setminus  \{target?\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lDeleteTaskS\_TQ\_Lemma]
with disabled (Task) prove by reduce;
use lDeleteTaskS\_T\_Lemma;
prove;
instantiate rtsk\_\_0 == rtsk;
prove by reduce;
apply inPower;
prove;
instantiate e\_\_5 == e;
instantiate e\_\_6 == e\_\_0;
apply applyOverride;
cases;
prove;
next;
prove;
next;
instantiate rtsk\_\_0 == t;
prove;
next;
\end{zproof}

\begin{theorem}{DeleteTaskS\_TQ\_vc\_ref}
\forall  DeleteTaskS\_TQFSBSig | true @ \pre  DeleteTaskS\_TQ
\end{theorem}

\begin{zproof}[DeleteTaskS\_TQ\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg, g := priority ];
with disabled (TaskQueue) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lDeleteTaskS\_TQ\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
\end{zproof}

\begin{zed}
DeleteTask\_TQ \defs DeleteTaskN\_TQ \lor  DeleteTaskS\_TQ
\end{zed}

\begin{zed}
ExecuteRunningTask\_TQ \defs ExtendTaskXi \land  ExecuteRunningTask\_T
\end{zed}

\begin{zed}
ExecuteRunningTask\_TQFSBSig \defs ExtTaskFSBSig \land  ExecuteRunningTask\_TFSBSig
\end{zed}

\begin{theorem}{ExecuteRunningTask\_TQ\_vc\_ref}
\forall  ExecuteRunningTask\_TQFSBSig | true @ \pre  ExecuteRunningTask\_TQ
\end{theorem}

\begin{zproof}[ExecuteRunningTask\_TQ\_vc\_ref]
with disabled (TaskData, StateData, PrioData) prove by reduce;
\end{zproof}

\begin{schema}{SuspendTaskN\_TQ}
  SuspendTaskN\_T\\
  \Delta TaskQueue
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  \Xi QueueData\\
  wait\_snd' = \{target?\} \ndres  wait\_snd\\
  wait\_rcv' = \{target?\} \ndres  wait\_rcv\\
  \Xi QReleasingData
\end{schema}

\begin{zed}
SuspendTaskN\_TQFSBSig \defs ExtTaskFSBSig \land  SuspendTaskN\_TFSBSig
\end{zed}

\begin{theorem}{SuspendTaskN\_TQ\_vc\_ref}
\forall  SuspendTaskN\_TQFSBSig | true @ \pre  SuspendTaskN\_TQ
\end{theorem}

\begin{zproof}[SuspendTaskN\_TQ\_vc\_ref]
use SuspendTaskN\_T\_vc\_ref;
prove by reduce;
apply extensionality to predicate (\dom  wait\_rcv \setminus  \{target?\}) \cap  (\dom  wait\_snd \setminus  \{target?\}) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \setminus  \{target?\} \cup  (\dom  wait\_snd \setminus  \{target?\})) = \{\};
prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
instantiate x\_\_2 == x\_\_0;
apply inPower;
prove;
instantiate e\_\_3 == e;
instantiate e\_\_4 == e\_\_0;
instantiate e\_\_7 == e\_\_1;
instantiate e\_\_8 == e\_\_2;
with enabled (inRan) prove;
instantiate x\_\_5 == x\_\_1;
instantiate x\_\_6 == x\_\_2;
apply applyOverride;
instantiate pt\_\_0 == pt;
prove;
\end{zproof}

\begin{zed}
SuspendTaskS\_TQ \defs ExtendTaskXi \land  SuspendTaskS\_T
\end{zed}

\begin{zed}
SuspendTaskS\_TQFSBSig \defs ExtTaskFSBSig \land  SuspendTaskS\_TFSBSig
\end{zed}

\begin{theorem}{lSuspendTaskS\_TQ\_Lemma}
\forall  TaskQueue; target?, topReady!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  target? \in  tasks \setminus  \{idle\} \land  state(target?) \in  \{running\} \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (TaskQueue[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lSuspendTaskS\_TQ\_Lemma]
use lSuspendTaskS\_T\_Lemma;
prove by reduce;
instantiate rtsk\_\_0 == rtsk;
prove;
apply inPower;
prove;
instantiate e\_\_5 == e;
instantiate e\_\_6 == e\_\_0;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
prove;
instantiate rtsk\_\_0 == pt;
apply applyOverride;
prove;
instantiate rtsk\_\_0 == t;
split pt = topReady!;
prove;
\end{zproof}

\begin{theorem}{SuspendTaskS\_TQ\_vc\_ref}
\forall  SuspendTaskS\_TQFSBSig | true @ \pre  SuspendTaskS\_TQ
\end{theorem}

\begin{zproof}[SuspendTaskS\_TQ\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg, g := priority ];
with disabled (TaskQueue) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lSuspendTaskS\_TQ\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
\end{zproof}

\begin{zed}
SuspendTaskO\_TQ \defs ExtendTaskXi \land  SuspendTaskO\_T
\end{zed}

\begin{zed}
SuspendTaskO\_TQFSBSig \defs ExtTaskFSBSig \land  SuspendTaskO\_TFSBSig
\end{zed}

\begin{theorem}{SuspendTaskO\_TQ\_vc\_ref}
\forall  SuspendTaskO\_TQFSBSig | true @ \pre  SuspendTaskO\_TQ
\end{theorem}

\begin{zproof}[SuspendTaskO\_TQ\_vc\_ref]
prove by reduce;
\end{zproof}

\begin{zed}
SuspendTask\_TQ \defs SuspendTaskN\_TQ \lor  SuspendTaskS\_TQ \lor  SuspendTaskO\_TQ
\end{zed}

\begin{zed}
ResumeTaskN\_TQ \defs ExtendTaskXi \land  ResumeTaskN\_T
\end{zed}

\begin{zed}
ResumeTaskN\_TQFSBSig \defs ExtTaskFSBSig \land  ResumeTaskN\_TFSBSig
\end{zed}

\begin{theorem}{ResumeTaskN\_TQ\_vc\_ref}
\forall  ResumeTaskN\_TQFSBSig | true @ \pre  ResumeTaskN\_TQ
\end{theorem}

\begin{zproof}[ResumeTaskN\_TQ\_vc\_ref]
use ResumeTaskN\_T\_vc\_ref;
prove by reduce;
apply inPower;
prove;
instantiate e\_\_5 == e;
instantiate e\_\_6 == e\_\_0;
apply applyOverride;
prove;
instantiate pt\_\_0 == pt;
split pt = target?;
prove;
\end{zproof}

\begin{zed}
ResumeTaskS\_TQ \defs ExtendTaskXi \land  ResumeTaskS\_T
\end{zed}

\begin{zed}
ResumeTaskS\_TQFSBSig \defs ExtTaskFSBSig \land  ResumeTaskS\_TFSBSig
\end{zed}

\begin{theorem}{ResumeTaskS\_TQ\_vc\_ref}
\forall  ResumeTaskS\_TQFSBSig | true @ \pre  ResumeTaskS\_TQ
\end{theorem}

\begin{zproof}[ResumeTaskS\_TQ\_vc\_ref]
use ResumeTaskS\_T\_vc\_ref;
with disabled (runningUpdate, setminUpdate) prove by reduce;
instantiate st\_\_0 == st;
prove;
apply inPower;
prove;
instantiate e\_\_5 == e;
instantiate e\_\_6 == e\_\_0;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
prove;
apply applyOverride;
instantiate pt\_\_0 == pt;
cases;
prove;
next;
prove;
next;
split pt = running\_task;
prove;
next;
\end{zproof}

\begin{zed}
ResumeTask\_TQ \defs ResumeTaskN\_TQ \lor  ResumeTaskS\_TQ
\end{zed}

\begin{zed}
ChangeTaskPriorityN\_TQ \defs ExtendTaskXi \land  ChangeTaskPriorityN\_T
\end{zed}

\begin{zed}
ChangeTaskPriorityN\_TQFSBSig \defs ExtTaskFSBSig \land  ChangeTaskPriorityN\_TFSBSig
\end{zed}

\begin{theorem}{ChangeTaskPriorityN\_TQ\_vc\_ref}
\forall  ChangeTaskPriorityN\_TQFSBSig | true @ \pre  ChangeTaskPriorityN\_TQ
\end{theorem}

\begin{zproof}[ChangeTaskPriorityN\_TQ\_vc\_ref]
with enabled (applyOverride) prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
instantiate t == pt;
with normalization prove;
\end{zproof}

\begin{zed}
ChangeTaskPriorityS\_TQ \defs ExtendTaskXi \land  ChangeTaskPriorityS\_T
\end{zed}

\begin{zed}
ChangeTaskPriorityS\_TQFSBSig \defs ExtTaskFSBSig \land  ChangeTaskPriorityS\_TFSBSig
\end{zed}

\begin{theorem}{ChangeTaskPriorityS\_TQ\_vc\_ref}
\forall  ChangeTaskPriorityS\_TQFSBSig | true @ \pre  ChangeTaskPriorityS\_TQ
\end{theorem}

\begin{zproof}[ChangeTaskPriorityS\_TQ\_vc\_ref]
use ChangeTaskPriorityS\_T\_vc\_ref;
prove by reduce;
instantiate st\_\_0 == st;
instantiate pt\_\_1 == pt;
prove;
apply inPower;
prove;
instantiate e\_\_5 == e;
instantiate e\_\_6 == e\_\_0;
prove;
apply applyOverride;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
prove;
cases;
prove;
next;
prove;
next;
prove;
next;
\end{zproof}

\begin{zed}
ChangeTaskPriorityD\_TQ \defs ExtendTaskXi \land  ChangeTaskPriorityD\_T
\end{zed}

\begin{zed}
ChangeTaskPriorityD\_TQFSBSig \defs ExtTaskFSBSig \land  ChangeTaskPriorityD\_TFSBSig
\end{zed}

\begin{theorem}{lChangeTaskPriorityD\_TQ\_Lemma}
\forall  TaskQueue; target?, topReady!: TASK; newpri?: \nat  | state(target?) = running \land  (target? = idle \implies  newpri? = 0) \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  newpri? < priority(topReady!) @ \lnot  (TaskQueue[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), priority := priority \oplus  \{(target?, newpri?)\}, running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})] \land  newpri? < priority(topReady!) \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lChangeTaskPriorityD\_TQ\_Lemma]
use lChangeTaskPriorityD\_T\_Lemma;
prove by reduce;
instantiate rtsk\_\_0 == rtsk;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
prove;
apply inPower;
prove;
instantiate e\_\_5 == e;
instantiate e\_\_6 == e\_\_0;
apply applyOverride;
instantiate rtsk\_\_0 == pt;
instantiate rtsk\_\_0 == t;
prove;
cases;
prove;
next;
prove;
next;
instantiate x == target?;
prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{ChangeTaskPriorityD\_TQ\_vc\_ref}
\forall  ChangeTaskPriorityD\_TQFSBSig | true @ \pre  ChangeTaskPriorityD\_TQ
\end{theorem}

\begin{zproof}[ChangeTaskPriorityD\_TQ\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg, g := priority ];
with disabled (TaskQueue) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lChangeTaskPriorityD\_TQ\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == readyTask;
instantiate t\_\_0 == rtsk;
instantiate t\_\_0 == t;
prove;
\end{zproof}

\begin{schema}{CreateQueue\_TQ}
  \Delta TaskQueue\\
  que?: QUEUE\\
  size?: \nat 
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  que? \notin  queue\\
  size? > 0\\
  \Xi Task\\
  queue' = queue \cup  \{que?\}\\
  q\_max' = q\_max \oplus  \{(que? \mapsto  size?)\}\\
  q\_size' = q\_size \oplus  \{(que? \mapsto  0)\}\\
  \Xi WaitingData\\
  \Xi QReleasingData
\end{schema}

\begin{schema}{CreateQueue\_TQFSBSig}
  TaskQueue\\
  que?: QUEUE\\
  size?: \nat 
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  que? \notin  queue\\
  size? > 0
\end{schema}

\begin{theorem}{CreateQueue\_TQ\_vc\_ref}
\forall  CreateQueue\_TQFSBSig | true @ \pre  CreateQueue\_TQ
\end{theorem}

\begin{zproof}[CreateQueue\_TQ\_vc\_ref]
prove by reduce;
apply applyOverride;
prove;
instantiate q\_\_0 == q;
apply inPower to predicate \ran  wait\_snd \in  \power  (\dom  q\_size);
instantiate e == q;
prove;
\end{zproof}

\begin{schema}{DeleteQueue\_TQ}
  \Delta TaskQueue\\
  que?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  que? \in  queue\\
  que? \notin  \ran  wait\_snd \cup  \ran  wait\_rcv\\
  que? \notin  \ran  release\_snd \cup  \ran  release\_rcv\\
  \Xi Task\\
  queue' = queue \setminus  \{que?\}\\
  q\_max' = \{que?\} \ndres  q\_max\\
  q\_size' = \{que?\} \ndres  q\_size\\
  \Xi WaitingData\\
  \Xi QReleasingData
\end{schema}

\begin{schema}{DeleteQueue\_TQFSBSig}
  TaskQueue\\
  que?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  que? \in  queue\\
  que? \notin  \ran  wait\_snd \cup  \ran  wait\_rcv\\
  que? \notin  \ran  release\_snd \cup  \ran  release\_rcv
\end{schema}

\begin{theorem}{DeleteQueue\_TQ\_vc\_ref}
\forall  DeleteQueue\_TQFSBSig | true @ \pre  DeleteQueue\_TQ
\end{theorem}

\begin{zproof}[DeleteQueue\_TQ\_vc\_ref]
prove by reduce;
apply inPower;
prove;
instantiate e\_\_3 == e;
instantiate e\_\_4 == e\_\_0;
instantiate e\_\_5 == e\_\_1;
instantiate e\_\_6 == e\_\_2;
prove;
\end{zproof}

\begin{schema}{QueueSendN\_TQ}
  \Delta TaskQueue\\
  que?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_rcv\\
  running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)\\
  que? \in  queue\\
  q\_size(que?) < q\_max(que?)\\
  que? \notin  \ran  wait\_rcv\\
  \Xi Task\\
  queue' = queue\\
  q\_max' = q\_max\\
  q\_size' = q\_size \oplus  \{(que? \mapsto  q\_size(que?) + 1)\}\\
  \Xi WaitingData\\
  release\_snd' = \{running\_task\} \ndres  release\_snd\\
  release\_rcv' = release\_rcv\\
  topReady! = running\_task
\end{schema}

\begin{zproof}[QueueSendN\_TQ\$domainCheck]
prove by reduce;
\end{zproof}

\begin{schema}{QueueSendN\_TQFSBSig}
  TaskQueue\\
  que?: QUEUE
\where
  running\_task \notin  \dom  release\_rcv\\
  running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)\\
  que? \in  queue\\
  q\_size(que?) < q\_max(que?)\\
  que? \notin  \ran  wait\_rcv
\end{schema}

\begin{zproof}[QueueSendN\_TQFSBSig\$domainCheck]
prove by reduce;
\end{zproof}

\begin{theorem}{QueueSendN\_TQ\_vc\_ref}
\forall  QueueSendN\_TQFSBSig | true @ \pre  QueueSendN\_TQ
\end{theorem}

\begin{zproof}[QueueSendN\_TQ\_vc\_ref]
prove by reduce;
use applyInRanPfun[QUEUE, \num ][A := QUEUE, B := \nat , f := q\_size, a := que?];
apply extensionality to predicate \dom  q\_max = \{que?\} \cup  \dom  q\_size;
apply extensionality to predicate \dom  release\_rcv \cap  (\dom  release\_snd \setminus  (state \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  (\dom  release\_snd \setminus  (state \inv  \limg  \{running\} \rimg ))) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
with enabled (inPower) prove;
instantiate q\_\_0 == q;
instantiate x\_\_2 == x;
instantiate x\_\_3 == x\_\_0;
instantiate e\_\_2 == e;
split y = que?;
prove;
apply applyOverride;
with enabled (inRan) prove;
instantiate x\_\_6 == x\_\_2;
split state(x\_\_1) = running;
prove;
\end{zproof}

\begin{schema}{QueueSendF\_TQ}
  \Delta TaskQueue\\
  que?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_rcv\\
  running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)\\
  que? \in  queue\\
  q\_size(que?) = q\_max(que?)\\
  running\_task \neq  idle\\
  state(topReady!) = ready\\
  \forall  t: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(t)\\
  \exists  st?: STATE | st? = blocked @ Reschedule[topReady!/target?, tasks/tasks?, priority/pri?]\\
  \Xi QueueData\\
  wait\_snd' = wait\_snd \oplus  \{(running\_task \mapsto  que?)\}\\
  wait\_rcv' = wait\_rcv\\
  release\_snd' = \{running\_task\} \ndres  release\_snd\\
  release\_rcv' = release\_rcv
\end{schema}

\begin{zproof}[QueueSendF\_TQ\$domainCheck]
prove by reduce;
\end{zproof}

\begin{schema}{QueueSendF\_TQFSBSig}
  TaskQueue\\
  que?: QUEUE
\where
  running\_task \notin  \dom  release\_rcv\\
  running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)\\
  que? \in  queue\\
  q\_size(que?) = q\_max(que?)\\
  running\_task \neq  idle
\end{schema}

\begin{zproof}[QueueSendF\_TQFSBSig\$domainCheck]
prove by reduce;
\end{zproof}

\begin{theorem}{lQueueSendF\_TQ\_Lemma}
\forall  TaskQueue; topReady!: TASK; que?: QUEUE | running\_task \notin  \dom  release\_rcv \land  (running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)) \land  que? \in  queue \land  q\_size(que?) = q\_max(que?) \land  running\_task \neq  idle \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (TaskQueue[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), release\_snd := \{running\_task\} \ndres  release\_snd, running\_task := topReady!, state := state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\}), wait\_snd := wait\_snd \oplus  \{(running\_task, que?)\}] \land  (t \in  TASK \land  state(t) = ready \implies  priority(topReady!) \geq  priority(t)) \implies  st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st = state(st) \land  \lnot  (state(st), (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st) \in  transition)
\end{theorem}

\begin{zproof}[lQueueSendF\_TQ\_Lemma]
prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{nonexistent\} \rimg );
apply extensionality to predicate (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
apply applyOverride;
apply inPower;
prove;
cases;
apply extensionality to predicate \dom  wait\_rcv \cap  ((state \inv  \limg  \{running\} \rimg ) \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate e\_\_4 == x;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate \dom  release\_rcv \cap  (\dom  release\_snd \setminus  (state \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate (\dom  release\_rcv \cup  (\dom  release\_snd \setminus  (state \inv  \limg  \{running\} \rimg ))) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
with normalization rewrite;
next;
instantiate e\_\_3 == e;
apply oplusDef to expression wait\_snd \oplus  \{(running\_task, que?)\};
with normalization prove;
with enabled (inRan) prove;
instantiate x\_\_1 == x;
prove;
next;
instantiate e\_\_5 == e\_\_0;
with enabled (inRan) prove;
instantiate x\_\_1 == x;
prove;
next;
with enabled (applyOverride) prove;
instantiate e\_\_4 == e\_\_1;
split e = running\_task;
prove;
next;
with enabled (applyOverride) prove;
instantiate e\_\_5 == e\_\_2;
split e = running\_task;
prove;
next;
with normalization rewrite;
next;
instantiate x == x\_\_0;
with normalization rewrite;
next;
prove;
next;
instantiate rtsk == pt;
split pt = running\_task;
prove;
next;
instantiate rtsk == t;
prove;
next;
with normalization rewrite;
next;
\end{zproof}

\begin{theorem}{QueueSendF\_TQ\_vc\_ref}
\forall  QueueSendF\_TQFSBSig | true @ \pre  QueueSendF\_TQ
\end{theorem}

\begin{zproof}[QueueSendF\_TQ\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg, g := priority ];
with disabled (TaskQueue) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lQueueSendF\_TQ\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
with normalization rewrite;
\end{zproof}

\begin{schema}{QueueSendW\_TQ}
  \Delta TaskQueue\\
  que?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_rcv\\
  running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)\\
  que? \in  queue\\
  q\_size(que?) < q\_max(que?)\\
  topReady! \in  wait\_rcv \inv  \limg  \{que?\} \rimg \\
  \forall  wr: wait\_rcv \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wr)\\
  priority(topReady!) \leq  priority(running\_task)\\
  \Xi TaskData\\
  state' = state \oplus  \{(topReady! \mapsto  ready)\}\\
  \Xi ContextData\\
  \Xi PrioData\\
  queue' = queue\\
  q\_max' = q\_max\\
  q\_size' = q\_size \oplus  \{(que? \mapsto  q\_size(que?) + 1)\}\\
  wait\_snd' = wait\_snd\\
  wait\_rcv' = \{topReady!\} \ndres  wait\_rcv\\
  release\_snd' = \{running\_task\} \ndres  release\_snd\\
  release\_rcv' = release\_rcv \oplus  \{(topReady! \mapsto  que?)\}
\end{schema}

\begin{zproof}[QueueSendW\_TQ\$domainCheck]
prove by reduce;
\end{zproof}

\begin{schema}{QueueSendW\_TQFSBSig}
  TaskQueue\\
  que?: QUEUE
\where
  running\_task \notin  \dom  release\_rcv\\
  running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)\\
  que? \in  queue\\
  q\_size(que?) < q\_max(que?)\\
  \forall  wr: wait\_rcv \inv  \limg  \{que?\} \rimg  @ priority(running\_task) \geq  priority(wr)
\end{schema}

\begin{zproof}[QueueSendW\_TQFSBSig\$domainCheck]
prove by reduce;
\end{zproof}

\begin{theorem}{lQueueSendW\_TQ\_Lemma}
\forall  TaskQueue; que?: QUEUE; topReady!: TASK | running\_task \notin  \dom  release\_rcv \land  (running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)) \land  que? \in  queue \land  q\_size(que?) < q\_max(que?) \land  topReady! \in  wait\_rcv \inv  \limg  \{que?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(running\_task) \geq  priority(topReady!) @ \lnot  (TaskQueue[q\_size := q\_size \oplus  \{(que?, (1 + q\_size(que?)))\}, release\_rcv := release\_rcv \oplus  \{(topReady!, que?)\}, release\_snd := \{running\_task\} \ndres  release\_snd, state := state \oplus  \{(topReady!, ready)\}, wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  priority(topReady!) \leq  priority(running\_task) \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topReady!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topReady!, ready)\}) st) \in  transition) \implies  wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = que? \land  \lnot  priority(topReady!) \geq  priority(wr))
\end{theorem}

\begin{zproof}[lQueueSendW\_TQ\_Lemma]
prove by reduce;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topReady!\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ));
apply extensionality to predicate \dom  wait\_snd \cap  (\dom  wait\_rcv \setminus  \{topReady!\}) = \{\};
prove;
apply applyOverride;
apply inPower;
prove;
instantiate e\_\_9 == topReady!;
with enabled (runningUpdate) prove;
cases;
with enabled (oplusDef) prove;
use applyInRanPfun[QUEUE, \num ][A := QUEUE, B := \nat , f := q\_size, a := wait\_rcv(topReady!)];
prove;
next;
apply extensionality to predicate \dom  q\_max = \{wait\_rcv(topReady!)\} \cup  \dom  q\_size;
with normalization prove;
next;
apply extensionality to predicate (\{topReady!\} \cup  \dom  release\_rcv) \cap  (\dom  release\_snd \setminus  (state \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate (\{topReady!\} \cup  (\dom  release\_rcv \cup  (\dom  release\_snd \setminus  (state \inv  \limg  \{running\} \rimg )))) \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topReady!\})) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
split x \in  \dom  wait\_snd;
prove;
next;
instantiate e\_\_5 == e;
with enabled (inRan) prove;
instantiate x\_\_0 == x;
prove;
next;
instantiate e\_\_6 == e\_\_0;
with enabled (inRan) prove;
instantiate x\_\_0 == x;
prove;
next;
instantiate e\_\_7 == e\_\_1;
apply oplusDef to expression release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\};
with enabled (inRan) prove;
instantiate x\_\_0 == x;
with normalization rewrite;
next;
instantiate e\_\_8 == e\_\_2;
with enabled (applyOverride) prove;
use inCap[TASK][A := \dom  wait\_snd, B := \dom  wait\_rcv, x := topReady!];
prove;
next;
instantiate e\_\_9 == e\_\_3;
prove;
next;
with normalization rewrite;
next;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == x;
prove;
next;
instantiate pt\_\_0 == pt;
with normalization rewrite;
next;
instantiate q\_\_0 == q;
prove;
next;
invoke transition;
prove;
next;
instantiate wrct == wr;
prove;
next;
\end{zproof}

\begin{theorem}{QueueSendW\_TQ\_vc\_ref}
\forall  QueueSendW\_TQFSBSig | true @ \pre  QueueSendW\_TQ
\end{theorem}

\begin{zproof}[QueueSendW\_TQ\_vc\_ref]
use findDelegate[a := wait\_rcv \inv  \limg  \{que?\} \rimg, g := priority ];
with disabled (TaskQueue) prove by reduce;
instantiate topReady! == f (wait\_rcv \inv  \limg  \{que?\} \rimg );
prove;
use lQueueSendW\_TQ\_Lemma[topReady! := f (wait\_rcv \inv  \limg  \{que?\} \rimg )];
prove;
instantiate wr\_\_0 == f (wait\_rcv \inv  \limg  \{que?\} \rimg );
instantiate t == wrct;
with normalization rewrite;
\end{zproof}

\begin{theorem}{TaskQueueProperty1}
\forall  TaskQueue @ \forall  t: TASK | t \in  \dom  wait\_rcv @ state(t) = blocked
\end{theorem}

\begin{zproof}[TaskQueueProperty1]
prove by reduce;
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == t;
prove;
\end{zproof}

\begin{schema}{QueueSendWS\_TQ}
  \Delta TaskQueue\\
  que?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_rcv\\
  running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)\\
  que? \in  queue\\
  q\_size(que?) < q\_max(que?)\\
  topReady! \in  wait\_rcv \inv  \limg  \{que?\} \rimg \\
  \forall  wr: wait\_rcv \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wr)\\
  priority(topReady!) > priority(running\_task)\\
  \exists  st?: STATE | st? = ready @ Reschedule[topReady!/target?, tasks/tasks?, priority/pri?]\\
  queue' = queue\\
  q\_max' = q\_max\\
  q\_size' = q\_size \oplus  \{(que? \mapsto  q\_size(que?) + 1)\}\\
  wait\_snd' = wait\_snd\\
  wait\_rcv' = \{topReady!\} \ndres  wait\_rcv\\
  release\_snd' = \{running\_task\} \ndres  release\_snd\\
  release\_rcv' = release\_rcv \oplus  \{(topReady! \mapsto  que?)\}
\end{schema}

\begin{zproof}[QueueSendWS\_TQ\$domainCheck]
prove by reduce;
\end{zproof}

\begin{schema}{QueueSendWS\_TQFSBSig}
  TaskQueue\\
  que?: QUEUE
\where
  running\_task \notin  \dom  release\_rcv\\
  running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)\\
  que? \in  queue\\
  q\_size(que?) < q\_max(que?)\\
  \exists  topReady!: wait\_rcv \inv  \limg  \{que?\} \rimg  | \forall  wr: wait\_rcv \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wr) @ priority(topReady!) > priority(running\_task)
\end{schema}

\begin{zproof}[QueueSendWS\_TQFSBSig\$domainCheck]
prove by reduce;
\end{zproof}

\begin{theorem}{lQueueSendWS\_TQ\_Lemma}
\forall  TaskQueue; que?: QUEUE; topReady!: TASK | running\_task \notin  \dom  release\_rcv \land  (running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)) \land  que? \in  queue \land  q\_size(que?) < q\_max(que?) \land  topReady! \in  wait\_rcv \inv  \limg  \{que?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(topReady!) > priority(running\_task) @ \lnot  (TaskQueue[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), q\_size := q\_size \oplus  \{(wait\_rcv(topReady!), (1 + q\_size (wait\_rcv(topReady!))))\}, release\_rcv := release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\}, release\_snd := \{running\_task\} \ndres  release\_snd, running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\}), wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  (wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = wait\_rcv(topReady!) \implies  priority(topReady!) \geq  priority(wr)) \implies  st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \land  \lnot  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition)
\end{theorem}

\begin{zproof}[lQueueSendWS\_TQ\_Lemma]
prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topReady!\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) \cup  (state \inv  \limg  \{running\} \rimg ));
apply extensionality to predicate (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
apply applyOverride;
apply inPower;
instantiate e\_\_4 == topReady!;
prove;
cases;
apply oplusDef to expression q\_size \oplus  \{(wait\_rcv(topReady!), (1 + q\_size (wait\_rcv(topReady!))))\};
use applyInRanPfun[QUEUE, \num ][A := QUEUE, B := \nat , f := q\_size, a := wait\_rcv(topReady!)];
prove;
next;
apply extensionality to predicate \dom  q\_max = \{wait\_rcv(topReady!)\} \cup  \dom  q\_size;
with normalization prove;
next;
apply extensionality to predicate \dom  wait\_snd \cap  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
with enabled (applyOverride) prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate (((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  \dom  release\_rcv) \cap  (\dom  release\_snd \setminus  (state \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
with enabled (applyOverride) prove;
instantiate x\_\_1 == x;
instantiate x\_\_2 == x;
prove;
next;
apply extensionality to predicate (((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  (\dom  release\_rcv \cup  (\dom  release\_snd \setminus  (state \inv  \limg  \{running\} \rimg )))) \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg ))) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
apply applyOverride;
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
instantiate x\_\_2 == x;
with normalization rewrite;
next;
instantiate e\_\_5 == e;
with enabled (inRan) prove;
instantiate x\_\_1 == x;
prove;
next;
instantiate e\_\_6 == e\_\_0;
with enabled (inRan) prove;
instantiate x\_\_1 == x;
prove;
next;
instantiate e\_\_7 == e\_\_1;
apply oplusDef to expression release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\};
with enabled (inRan) prove;
instantiate x\_\_1 == x;
with normalization rewrite;
next;
instantiate e\_\_8 == e\_\_2;
with enabled (applyOverride) prove;
use inCap[TASK][A := \dom  wait\_snd, B := \dom  wait\_rcv, x := topReady!];
prove;
next;
instantiate e\_\_9 == e\_\_3;
with enabled (applyOverride) prove;
next;
with normalization rewrite;
next;
instantiate x\_\_0 == x;
with normalization prove;
next;
with normalization rewrite;
next;
instantiate pt\_\_0 == pt;
with normalization rewrite;
next;
instantiate q\_\_0 == q;
prove;
next;
instantiate wrct == wr;
prove;
next;
with normalization rewrite;
next;
\end{zproof}

\begin{theorem}{QueueSendWS\_TQ\_vc\_ref}
\forall  QueueSendWS\_TQFSBSig | true @ \pre  QueueSendWS\_TQ
\end{theorem}

\begin{zproof}[QueueSendWS\_TQ\_vc\_ref]
with disabled (TaskQueue) prove by reduce;
instantiate running\_task' == topReady!;
prove;
use lQueueSendWS\_TQ\_Lemma;
prove;
instantiate wr\_\_0 == wrct;
prove;
with normalization rewrite;
\end{zproof}

\begin{zed}
QueueSend\_TQ \defs QueueSendN\_TQ \lor  QueueSendF\_TQ \lor  QueueSendW\_TQ \lor  QueueSendWS\_TQ
\end{zed}

\begin{schema}{QueueReceiveN\_TQ}
  \Delta TaskQueue\\
  que?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)\\
  que? \in  queue\\
  q\_size(que?) > 0\\
  que? \notin  \ran  wait\_snd\\
  \Xi Task\\
  queue' = queue\\
  q\_max' = q\_max\\
  q\_size' = q\_size \oplus  \{(que? \mapsto  q\_size(que?) - 1)\}\\
  \Xi WaitingData\\
  release\_snd' = release\_snd\\
  release\_rcv' = \{running\_task\} \ndres  release\_rcv\\
  topReady! = running\_task
\end{schema}

\begin{zproof}[QueueReceiveN\_TQ\$domainCheck]
prove by reduce;
\end{zproof}

\begin{schema}{QueueReceiveN\_TQFSBSig}
  TaskQueue\\
  que?: QUEUE
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)\\
  que? \in  queue\\
  q\_size(que?) > 0\\
  que? \notin  \ran  wait\_snd
\end{schema}

\begin{zproof}[QueueReceiveN\_TQFSBSig\$domainCheck]
prove by reduce;
\end{zproof}

\begin{theorem}{QueueReceiveN\_TQ\_vc\_ref}
\forall  QueueReceiveN\_TQFSBSig | true @ \pre  QueueReceiveN\_TQ
\end{theorem}

\begin{zproof}[QueueReceiveN\_TQ\_vc\_ref]
prove by reduce;
use applyInRanPfun[QUEUE, \num ][A := QUEUE, B := \nat , f := q\_size, a := que?];
apply extensionality to predicate \dom  q\_max = \{que?\} \cup  \dom  q\_size;
apply extensionality to predicate \dom  release\_snd \cap  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
apply extensionality to predicate (\dom  release\_snd \cup  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg ))) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
with enabled (inPower) prove;
instantiate q\_\_0 == q;
instantiate x\_\_2 == x;
instantiate x\_\_3 == x\_\_0;
instantiate e\_\_3 == e;
split y = que?;
prove;
apply applyOverride;
with enabled (inRan) prove;
instantiate x\_\_6 == x\_\_2;
split x\_\_1 \in  \dom  release\_rcv \land  \lnot  state(x\_\_1) = running;
split q = que?;
prove;
\end{zproof}

\begin{schema}{QueueReceiveE\_TQ}
  \Delta TaskQueue\\
  que?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)\\
  que? \in  queue\\
  q\_size(que?) = 0\\
  running\_task \neq  idle\\
  state(topReady!) = ready\\
  \forall  t: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(t)\\
  \exists  st?: STATE | st? = blocked @ Reschedule[topReady!/target?, tasks/tasks?, priority/pri?]\\
  \Xi QueueData\\
  wait\_snd' = wait\_snd\\
  wait\_rcv' = wait\_rcv \oplus  \{(running\_task \mapsto  que?)\}\\
  release\_snd' = release\_snd\\
  release\_rcv' = \{running\_task\} \ndres  release\_rcv
\end{schema}

\begin{zproof}[QueueReceiveE\_TQ\$domainCheck]
prove by reduce;
\end{zproof}

\begin{schema}{QueueReceiveE\_TQFSBSig}
  TaskQueue\\
  que?: QUEUE
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)\\
  que? \in  queue\\
  q\_size(que?) = 0\\
  running\_task \neq  idle
\end{schema}

\begin{zproof}[QueueReceiveE\_TQFSBSig\$domainCheck]
prove by reduce;
\end{zproof}

\begin{theorem}{lQueueReceiveE\_TQ\_Lemma}
\forall  TaskQueue; que?: QUEUE; topReady!: TASK | running\_task \notin  \dom  release\_snd \land  (running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)) \land  que? \in  queue \land  q\_size(que?) = 0 \land  running\_task \neq  idle \land  topReady! \in  state \inv  \limg  \{ready\} \rimg  \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (TaskQueue[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), release\_rcv := \{running\_task\} \ndres  release\_rcv, running\_task := topReady!, state := state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\}), wait\_rcv := wait\_rcv \oplus  \{(running\_task, que?)\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lQueueReceiveE\_TQ\_Lemma]
prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{nonexistent\} \rimg );
apply extensionality to predicate (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
apply applyOverride;
apply inPower;
prove;
cases;
apply extensionality to predicate \dom  wait\_snd \cap  ((state \inv  \limg  \{running\} \rimg ) \cup  \dom  wait\_rcv) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate e\_\_3 == x;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate \dom  release\_snd \cap  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate (\dom  release\_snd \cup  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg ))) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
with normalization rewrite;
next;
instantiate e\_\_4 == e;
apply oplusDef to expression wait\_rcv \oplus  \{(running\_task, que?)\};
with normalization prove;
with enabled (inRan) prove;
instantiate x\_\_1 == x;
prove;
next;
instantiate e\_\_6 == e\_\_0;
with enabled (inRan) prove;
instantiate x\_\_1 == x;
prove;
next;
with enabled (applyOverride) prove;
instantiate e\_\_4 == e\_\_1;
split e = running\_task;
prove;
next;
with enabled (applyOverride) prove;
instantiate e\_\_5 == e\_\_2;
split e = running\_task;
prove;
next;
with normalization rewrite;
next;
instantiate x == x\_\_0;
with normalization rewrite;
next;
prove;
next;
instantiate rtsk == pt;
split pt = running\_task;
prove;
next;
with normalization rewrite;
next;
instantiate rtsk == t;
prove;
next;
\end{zproof}

\begin{theorem}{QueueReceiveE\_TQ\_vc\_ref}
\forall  QueueReceiveE\_TQFSBSig | true @ \pre  QueueReceiveE\_TQ
\end{theorem}

\begin{zproof}[QueueReceiveE\_TQ\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg, g := priority ];
with disabled (TaskQueue) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lQueueReceiveE\_TQ\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
with normalization rewrite;
\end{zproof}

\begin{schema}{QueueReceiveW\_TQ}
  \Delta TaskQueue\\
  que?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)\\
  que? \in  queue\\
  q\_size(que?) > 0\\
  topReady! \in  wait\_snd \inv  \limg  \{que?\} \rimg \\
  \forall  ws: wait\_snd \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(ws)\\
  priority(topReady!) \leq  priority(running\_task)\\
  \Xi TaskData\\
  state' = state \oplus  \{(topReady! \mapsto  ready)\}\\
  \Xi ContextData\\
  \Xi PrioData\\
  queue' = queue\\
  q\_max' = q\_max\\
  q\_size' = q\_size \oplus  \{(que? \mapsto  q\_size(que?) - 1)\}\\
  wait\_snd' = \{topReady!\} \ndres  wait\_snd\\
  wait\_rcv' = wait\_rcv\\
  release\_snd' = release\_snd \oplus  \{(topReady! \mapsto  que?)\}\\
  release\_rcv' = \{running\_task\} \ndres  release\_rcv
\end{schema}

\begin{zproof}[QueueReceiveW\_TQ\$domainCheck]
prove by reduce;
\end{zproof}

\begin{schema}{QueueReceiveW\_TQFSBSig}
  TaskQueue\\
  que?: QUEUE
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)\\
  que? \in  queue\\
  q\_size(que?) > 0\\
  \forall  ws: wait\_snd \inv  \limg  \{que?\} \rimg  @ priority(running\_task) \geq  priority(ws)
\end{schema}

\begin{zproof}[QueueReceiveW\_TQFSBSig\$domainCheck]
prove by reduce;
\end{zproof}

\begin{theorem}{lQueueReceiveW\_TQ\_Lemma}
\forall  TaskQueue; que?: QUEUE; topReady!: TASK | running\_task \notin  \dom  release\_snd \land  (running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)) \land  que? \in  queue \land  q\_size(que?) > 0 \land  topReady! \in  wait\_snd \inv  \limg  \{que?\} \rimg  \land  (\forall  wsnt: wait\_snd \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wsnt)) \land  priority(running\_task) \geq  priority(topReady!) @ \lnot  (TaskQueue[q\_size := q\_size \oplus  \{(que?, (q\_size(que?) - 1))\}, release\_rcv := \{running\_task\} \ndres  release\_rcv, release\_snd := release\_snd \oplus  \{(topReady!, que?)\}, state := state \oplus  \{(topReady!, ready)\}, wait\_snd := \{topReady!\} \ndres  wait\_snd] \land  priority(topReady!) \leq  priority(running\_task) \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topReady!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topReady!, ready)\}) st) \in  transition) \implies  ws \in  \dom  wait\_snd \land  wait\_snd(ws) = que? \land  \lnot  priority(topReady!) \geq  priority(ws))
\end{theorem}

\begin{zproof}[lQueueReceiveW\_TQ\_Lemma]
prove by reduce;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topReady!\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ));
apply extensionality to predicate \dom  wait\_rcv \cap  (\dom  wait\_snd \setminus  \{topReady!\}) = \{\};
prove;
apply applyOverride;
apply inPower;
prove;
instantiate e\_\_8 == topReady!;
with enabled (runningUpdate) prove;
cases;
apply extensionality to predicate \dom  q\_max = \{wait\_snd(topReady!)\} \cup  \dom  q\_size;
with normalization prove;
next;
apply extensionality to predicate (\{topReady!\} \cup  \dom  release\_snd) \cap  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate (\{topReady!\} \cup  (\dom  release\_snd \cup  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg )))) \cap  (\dom  wait\_rcv \cup  (\dom  wait\_snd \setminus  \{topReady!\})) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
split x \in  \dom  wait\_rcv;
prove;
next;
instantiate e\_\_4 == e;
with enabled (inRan) prove;
instantiate x\_\_0 == x;
prove;
next;
instantiate e\_\_6 == e\_\_0;
apply oplusDef to expression release\_snd \oplus  \{(topReady!, wait\_snd(topReady!))\};
with enabled (inRan) prove;
instantiate x\_\_0 == x;
with normalization rewrite;
next;
instantiate e\_\_7 == e\_\_1;
with enabled (inRan) prove;
instantiate x\_\_0 == x;
prove;
next;
instantiate e\_\_8 == e\_\_2;
prove;
next;
instantiate e\_\_9 == e\_\_3;
with enabled (applyOverride) prove;
use inCap[TASK][A := \dom  wait\_snd, B := \dom  wait\_rcv, x := topReady!];
prove;
next;
with normalization rewrite;
next;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == x;
prove;
next;
instantiate pt\_\_0 == pt;
with normalization rewrite;
next;
instantiate q\_\_0 == q;
prove;
next;
invoke transition;
prove;
next;
instantiate wsnt == ws;
prove;
next;
\end{zproof}

\begin{theorem}{QueueReceiveW\_TQ\_vc\_ref}
\forall  QueueReceiveW\_TQFSBSig | true @ \pre  QueueReceiveW\_TQ
\end{theorem}

\begin{zproof}[QueueReceiveW\_TQ\_vc\_ref]
use findDelegate[a := wait\_snd \inv  \limg  \{que?\} \rimg, g := priority ];
with disabled (TaskQueue) prove by reduce;
instantiate topReady! == f (wait\_snd \inv  \limg  \{que?\} \rimg );
prove;
use lQueueReceiveW\_TQ\_Lemma[topReady! := f (wait\_snd \inv  \limg  \{que?\} \rimg )];
prove;
instantiate ws\_\_0 == f (wait\_snd \inv  \limg  \{que?\} \rimg );
instantiate t == wsnt;
with normalization rewrite;
\end{zproof}

\begin{schema}{QueueReceiveWS\_TQ}
  \Delta TaskQueue\\
  que?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)\\
  que? \in  queue\\
  q\_size(que?) > 0\\
  topReady! \in  wait\_snd \inv  \limg  \{que?\} \rimg \\
  \forall  ws: wait\_snd \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(ws)\\
  priority(topReady!) > priority(running\_task)\\
  \exists  st?: STATE | st? = ready @ Reschedule[topReady!/target?, tasks/tasks?, priority/pri?]\\
  queue' = queue\\
  q\_max' = q\_max\\
  q\_size' = q\_size \oplus  \{(que? \mapsto  q\_size(que?) - 1)\}\\
  wait\_snd' = \{topReady!\} \ndres  wait\_snd\\
  wait\_rcv' = wait\_rcv\\
  release\_snd' = release\_snd \oplus  \{(topReady! \mapsto  que?)\}\\
  release\_rcv' = \{running\_task\} \ndres  release\_rcv
\end{schema}

\begin{zproof}[QueueReceiveWS\_TQ\$domainCheck]
prove by reduce;
\end{zproof}

\begin{schema}{QueueReceiveWS\_TQFSBSig}
  TaskQueue\\
  que?: QUEUE
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)\\
  que? \in  queue\\
  q\_size(que?) > 0\\
  \exists  topReady!: wait\_snd \inv  \limg  \{que?\} \rimg  | \forall  ws: wait\_snd \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(ws) @ priority(topReady!) > priority(running\_task)
\end{schema}

\begin{zproof}[QueueReceiveWS\_TQFSBSig\$domainCheck]
prove by reduce;
\end{zproof}

\begin{theorem}{lQueueReceiveWS\_TQ\_Lemma}
\forall  TaskQueue; que?: QUEUE; topReady!: TASK | running\_task \notin  \dom  release\_snd \land  (running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)) \land  que? \in  queue \land  q\_size(que?) > 0 \land  topReady! \in  wait\_snd \inv  \limg  \{que?\} \rimg  \land  (\forall  wsnt: wait\_snd \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wsnt)) \land  priority(topReady!) > priority(running\_task) @ \lnot  (TaskQueue[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), q\_size := q\_size \oplus  \{(wait\_snd(topReady!), (q\_size (wait\_snd(topReady!)) - 1))\}, release\_rcv := \{running\_task\} \ndres  release\_rcv, release\_snd := release\_snd \oplus  \{(topReady!, wait\_snd(topReady!))\}, running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\}), wait\_snd := \{topReady!\} \ndres  wait\_snd] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  ws \in  \dom  wait\_snd \land  wait\_snd(ws) = wait\_snd(topReady!) \land  \lnot  priority(topReady!) \geq  priority(ws))
\end{theorem}

\begin{zproof}[lQueueReceiveWS\_TQ\_Lemma]
prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topReady!\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) \cup  (state \inv  \limg  \{running\} \rimg ));
apply extensionality to predicate (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
apply applyOverride;
apply inPower;
instantiate e\_\_3 == topReady!;
prove;
cases;
apply extensionality to predicate \dom  q\_max = \{wait\_snd(topReady!)\} \cup  \dom  q\_size;
with normalization prove;
next;
apply extensionality to predicate \dom  wait\_rcv \cap  (\dom  wait\_snd \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
with enabled (applyOverride) prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate (((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  \dom  release\_snd) \cap  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
with enabled (applyOverride) prove;
instantiate x\_\_1 == x;
instantiate x\_\_2 == x;
prove;
next;
apply extensionality to predicate (((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  (\dom  release\_snd \cup  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg )))) \cap  (\dom  wait\_rcv \cup  (\dom  wait\_snd \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg ))) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
apply applyOverride;
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
instantiate x\_\_2 == x;
with normalization rewrite;
next;
instantiate e\_\_4 == e;
with enabled (inRan) prove;
instantiate x\_\_1 == x;
prove;
next;
instantiate e\_\_6 == e\_\_0;
apply oplusDef to expression release\_snd \oplus  \{(topReady!, wait\_snd(topReady!))\};
with enabled (inRan) prove;
instantiate x\_\_1 == x;
with normalization rewrite;
next;
instantiate e\_\_7 == e\_\_1;
with enabled (inRan) prove;
instantiate x\_\_1 == x;
prove;
next;
instantiate e\_\_8 == e\_\_2;
with enabled (applyOverride) prove;
next;
instantiate e\_\_9 == e\_\_3;
with enabled (applyOverride) prove;
use inCap[TASK][A := \dom  wait\_snd, B := \dom  wait\_rcv, x := topReady!];
prove;
next;
with normalization rewrite;
next;
instantiate x\_\_0 == x;
with normalization prove;
next;
with normalization rewrite;
next;
instantiate pt\_\_0 == pt;
with normalization rewrite;
next;
instantiate q\_\_0 == q;
prove;
next;
with normalization rewrite;
next;
instantiate wsnt == ws;
prove;
next;
\end{zproof}

\begin{theorem}{QueueReceiveWS\_TQ\_vc\_ref}
\forall  QueueReceiveWS\_TQFSBSig | true @ \pre  QueueReceiveWS\_TQ
\end{theorem}

\begin{zproof}[QueueReceiveWS\_TQ\_vc\_ref]
with disabled (TaskQueue) prove by reduce;
instantiate running\_task' == topReady!;
prove;
use lQueueReceiveWS\_TQ\_Lemma;
prove;
instantiate ws\_\_0 == wsnt;
prove;
with normalization rewrite;
\end{zproof}

\begin{zed}
QueueReceive\_TQ \defs QueueReceiveN\_TQ \lor  QueueReceiveE\_TQ \lor  QueueReceiveW\_TQ \lor  QueueReceiveWS\_TQ
\end{zed}

\begin{axdef}
  slice\_delay: \nat 
\where
  \Label{disabled slice_delay_def}  slice\_delay = 1
\end{axdef}

\begin{schema}{Time}
  clock: \nat \\
  delayed\_task: \power  TASK\\
  time: TASK \pfun  \nat \\
  time\_slice: \nat 
\where
  \forall  t: \dom  time @ time(t) \geq  clock
\end{schema}

\begin{zproof}[Time\$domainCheck]
 prove;
\end{zproof}

\begin{schema}{Init\_Time}
  Time~'
\where
  clock' = 0\\
  delayed\_task' = \emptyset\\
  time' = \emptyset\\
  time\_slice' = slice\_delay
\end{schema}

\begin{theorem}{TimeInit}
\exists  Time~' @ Init\_Time
\end{theorem}

\begin{zproof}[TimeInit]
 prove by reduce;
\end{zproof}

\begin{schema}{TaskQueueTime}
  TaskQueue\\
  Time
\where
  \langle delayed\_task, \dom  wait\_snd, \dom  wait\_rcv\rangle  \partition  \dom  time\\
  delayed\_task \subseteq  state \inv  \limg  \{blocked\} \rimg 
\end{schema}

\begin{theorem}{rule domTime}
\forall  TaskQueueTime; t: TASK | t \in  \dom  time @ t \in  state \inv  \limg  \{blocked\} \rimg 
\end{theorem}

\begin{zproof}[domTime]
invoke TaskQueueTime;
invoke TaskQueue;
prove;
apply extensionality to predicate delayed\_task \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \dom  time;
instantiate y == t;
with enabled (inPower) prove;
instantiate e == t;
instantiate e\_\_0 == t;
instantiate e\_\_1 == t;
with normalization rewrite;
\end{zproof}

\begin{schema}{Init\_TaskQueueTime}
  TaskQueueTime~'
\where
  Init\_TaskQueue\\
  Init\_Time
\end{schema}

\begin{theorem}{TaskQueueTimeInit}
\exists  TaskQueueTime~' @ Init\_TaskQueueTime
\end{theorem}

\begin{zproof}[TaskQueueTimeInit]
 use TaskQueueInit;
with enabled (disjointCat) prove by reduce;
\end{zproof}

\begin{zed}
\Delta TaskQueueTime \defs TaskQueueTime \land  TaskQueueTime~' \land  \Delta Task
\end{zed}

\begin{schema}{ExtendTaskQueueXi}
  \Delta TaskQueueTime
\where
  \Xi Time
\end{schema}

\begin{zed}
CreateTaskN\_TQT \defs ExtendTaskQueueXi \land  CreateTaskN\_TQ
\end{zed}

\begin{zed}
CreateTaskN\_TQTFSBSig \defs TaskQueueTime \land  CreateTaskN\_TQFSBSig
\end{zed}

\begin{theorem}{CreateTaskN\_TQT\_vc\_ref}
\forall  CreateTaskN\_TQTFSBSig | true @ \pre  CreateTaskN\_TQT
\end{theorem}

\begin{zproof}[CreateTaskN\_TQT\_vc\_ref]
use CreateTaskN\_TQ\_vc\_ref;
with disabled (TaskQueue) prove by reduce;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  \{(target?, ready)\}) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
with enabled (applyOverride) prove;
\end{zproof}

\begin{zed}
CreateTaskS\_TQT \defs ExtendTaskQueueXi \land  CreateTaskS\_TQ
\end{zed}

\begin{zed}
CreateTaskS\_TQTFSBSig \defs TaskQueueTime \land  CreateTaskS\_TQFSBSig
\end{zed}

\begin{theorem}{CreateTaskS\_TQT\_vc\_ref}
\forall  CreateTaskS\_TQTFSBSig | true @ \pre  CreateTaskS\_TQT
\end{theorem}

\begin{zproof}[CreateTaskS\_TQT\_vc\_ref]
use CreateTaskS\_TQ\_vc\_ref;
with disabled (TaskQueue) prove by reduce;
instantiate st\_\_0 == st;
with disabled (Queue, TaskData, PrioData, ContextData) prove by reduce;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(target?, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
prove;
\end{zproof}

\begin{zed}
CreateTask\_TQT \defs CreateTaskN\_TQT \lor  CreateTaskS\_TQT
\end{zed}

\begin{schema}{DeleteTaskN\_TQT}
  DeleteTaskN\_TQ\\
  \Delta TaskQueueTime
\where
  clock' = clock\\
  delayed\_task' = delayed\_task \setminus  \{target?\}\\
  time' = \{target?\} \ndres  time\\
  time\_slice' = time\_slice
\end{schema}

\begin{zed}
DeleteTaskN\_TQTFSBSig \defs TaskQueueTime \land  DeleteTaskN\_TQFSBSig
\end{zed}

\begin{theorem}{DeleteTaskN\_TQT\_vc\_ref}
\forall  DeleteTaskN\_TQTFSBSig | true @ \pre  DeleteTaskN\_TQT
\end{theorem}

\begin{zproof}[DeleteTaskN\_TQT\_vc\_ref]
use DeleteTaskN\_TQ\_vc\_ref;
with disabled (TaskQueue, partitionDef) prove by reduce;
cases;
with enabled (disjointCat) prove;
apply extensionality to predicate (\dom  wait\_rcv \setminus  \{target?\}) \cap  (\dom  wait\_snd \setminus  \{target?\}) = \{\};
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate (delayed\_task \setminus  \{target?\}) \cap  (\dom  wait\_rcv \setminus  \{target?\} \cup  (\dom  wait\_snd \setminus  \{target?\})) = \{\};
apply extensionality to predicate delayed\_task \setminus  \{target?\} \cup  (\dom  wait\_rcv \setminus  \{target?\} \cup  (\dom  wait\_snd \setminus  \{target?\})) = delayed\_task \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd) \setminus  \{target?\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_1 == x;
instantiate x\_\_2 == x\_\_0;
prove;
next;
apply inPower to predicate delayed\_task \setminus  \{target?\} \in  \power  ((state \oplus  \{(target?, nonexistent)\}) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
instantiate pt\_\_0 == pt;
apply applyOverride to expression (state \oplus  \{(target?, nonexistent)\}) pt;
prove;
next;
with enabled (applyOverride) prove;
next;
instantiate t\_\_0 == t;
prove;
next;
\end{zproof}

\begin{zed}
DeleteTaskS\_TQT \defs ExtendTaskQueueXi \land  DeleteTaskS\_TQ
\end{zed}

\begin{zed}
DeleteTaskS\_TQTFSBSig \defs TaskQueueTime \land  DeleteTaskS\_TQFSBSig
\end{zed}

\begin{theorem}{lDeleteTaskS\_TQT\_Lemma}
\forall  TaskQueueTime; topReady!, target?: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  target? \in  tasks \setminus  \{idle\} \land  state(target?) \in  \{running\} \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (TaskQueueTime[log\_context := log\_context \oplus  \{(target?, bare\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\}), tasks := tasks \setminus  \{target?\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lDeleteTaskS\_TQT\_Lemma]
with disabled (TaskQueue) prove by reduce;
use lDeleteTaskS\_TQ\_Lemma;
prove;
instantiate rtsk\_\_0 == rtsk;
prove;
with disabled (Queue, TaskData, PrioData, ContextData) prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
instantiate rtsk\_\_0 == t;
with enabled (applyOverride) prove;
\end{zproof}

\begin{theorem}{DeleteTaskS\_TQT\_vc\_ref}
\forall  DeleteTaskS\_TQTFSBSig | true @ \pre  DeleteTaskS\_TQT
\end{theorem}

\begin{zproof}[DeleteTaskS\_TQT\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTime) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lDeleteTaskS\_TQT\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
\end{zproof}

\begin{zed}
DeleteTask\_TQT \defs DeleteTaskN\_TQT \lor  DeleteTaskS\_TQT
\end{zed}

\begin{zed}
ExecuteRunningTask\_TQT \defs ExtendTaskQueueXi \land  ExecuteRunningTask\_TQ
\end{zed}

\begin{zed}
ExecuteRunningTask\_TQTFSBSig \defs TaskQueueTime \land  ExecuteRunningTask\_TQFSBSig
\end{zed}

\begin{theorem}{ExecuteRunningTask\_TQT\_vc\_ref}
\forall  ExecuteRunningTask\_TQTFSBSig | true @ \pre  ExecuteRunningTask\_TQT
\end{theorem}

\begin{zproof}[ExecuteRunningTask\_TQT\_vc\_ref]
 with disabled (TaskData, StateData, PrioData, Queue, Time) reduce;
\end{zproof}

\begin{schema}{SuspendTaskN\_TQT}
  SuspendTaskN\_TQ\\
  \Delta TaskQueueTime
\where
  clock' = clock\\
  delayed\_task' = delayed\_task \setminus  \{target?\}\\
  time' = \{target?\} \ndres  time\\
  time\_slice' = time\_slice
\end{schema}

\begin{zed}
SuspendTaskN\_TQTFSBSig \defs TaskQueueTime \land  SuspendTaskN\_TQFSBSig
\end{zed}

\begin{theorem}{SuspendTaskN\_TQT\_vc\_ref}
\forall  SuspendTaskN\_TQTFSBSig | true @ \pre  SuspendTaskN\_TQT
\end{theorem}

\begin{zproof}[SuspendTaskN\_TQT\_vc\_ref]
use SuspendTaskN\_TQ\_vc\_ref;
with disabled (TaskQueue, partitionDef) prove by reduce;
cases;
with disabled (Queue, PrioData, StateData, ContextData) prove by reduce;
next;
with enabled (disjointCat) prove;
apply extensionality to predicate (\dom  wait\_rcv \setminus  \{target?\}) \cap  (\dom  wait\_snd \setminus  \{target?\}) = \{\};
apply extensionality to predicate (delayed\_task \setminus  \{target?\}) \cap  (\dom  wait\_rcv \setminus  \{target?\} \cup  (\dom  wait\_snd \setminus  \{target?\})) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate delayed\_task \setminus  \{target?\} \cup  (\dom  wait\_rcv \setminus  \{target?\} \cup  (\dom  wait\_snd \setminus  \{target?\})) = delayed\_task \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd) \setminus  \{target?\};
prove;
instantiate x\_\_1 == x;
instantiate x\_\_2 == x\_\_0;
prove;
next;
apply inPower to predicate delayed\_task \setminus  \{target?\} \in  \power  ((state \oplus  \{(target?, suspended)\}) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
instantiate pt\_\_0 == pt;
with enabled (applyOverride) prove;
next;
instantiate st\_\_0 == st;
prove;
next;
instantiate t\_\_0 == t;
prove;
next;
\end{zproof}

\begin{zed}
SuspendTaskS\_TQT \defs ExtendTaskQueueXi \land  SuspendTaskS\_TQ
\end{zed}

\begin{zed}
SuspendTaskS\_TQTFSBSig \defs TaskQueueTime \land  SuspendTaskS\_TQFSBSig
\end{zed}

\begin{theorem}{lSuspendTaskS\_TQT\_Lemma}
\forall  TaskQueueTime; target?, topReady!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  target? \in  tasks \setminus  \{idle\} \land  state(target?) \in  \{running\} \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (TaskQueueTime[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lSuspendTaskS\_TQT\_Lemma]
use lSuspendTaskS\_TQ\_Lemma;
with disabled (TaskQueue) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
prove;
with disabled (TaskData, PrioData, ContextData, Queue) reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
instantiate rtsk\_\_0 == t;
with enabled (applyOverride) prove;
\end{zproof}

\begin{theorem}{SuspendTaskS\_TQT\_vc\_ref}
\forall  SuspendTaskS\_TQTFSBSig | true @ \pre  SuspendTaskS\_TQT
\end{theorem}

\begin{zproof}[SuspendTaskS\_TQT\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTime) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lSuspendTaskS\_TQT\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
\end{zproof}

\begin{zed}
SuspendTaskO\_TQT \defs ExtendTaskQueueXi \land  SuspendTaskO\_TQ
\end{zed}

\begin{zed}
SuspendTaskO\_TQTFSBSig \defs TaskQueueTime \land  SuspendTaskO\_TQFSBSig
\end{zed}

\begin{theorem}{SuspendTaskO\_TQT\_vc\_ref}
\forall  SuspendTaskO\_TQTFSBSig | true @ \pre  SuspendTaskO\_TQT
\end{theorem}

\begin{zproof}[SuspendTaskO\_TQT\_vc\_ref]
with disabled (TaskQueueTime) prove by reduce;
\end{zproof}

\begin{zed}
SuspendTask\_TQT \defs SuspendTaskN\_TQT \lor  SuspendTaskS\_TQT \lor  SuspendTaskO\_TQT
\end{zed}

\begin{zed}
ResumeTaskN\_TQT \defs ExtendTaskQueueXi \land  ResumeTaskN\_TQ
\end{zed}

\begin{zed}
ResumeTaskN\_TQTFSBSig \defs TaskQueueTime \land  ResumeTaskN\_TQFSBSig
\end{zed}

\begin{theorem}{ResumeTaskN\_TQT\_vc\_ref}
\forall  ResumeTaskN\_TQTFSBSig | true @ \pre  ResumeTaskN\_TQT
\end{theorem}

\begin{zproof}[ResumeTaskN\_TQT\_vc\_ref]
use ResumeTaskN\_TQ\_vc\_ref;
with disabled (TaskQueue) prove by reduce;
instantiate st\_\_0 == st;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  \{(target?, ready)\}) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
with disabled (Queue, TaskData, PrioData, ContextData) prove by reduce;
instantiate e\_\_0 == e;
with enabled (applyOverride) prove;
\end{zproof}

\begin{zed}
ResumeTaskS\_TQT \defs ExtendTaskQueueXi \land  ResumeTaskS\_TQ
\end{zed}

\begin{zed}
ResumeTaskS\_TQTFSBSig \defs TaskQueueTime \land  ResumeTaskS\_TQFSBSig
\end{zed}

\begin{theorem}{ResumeTaskS\_TQT\_vc\_ref}
\forall  ResumeTaskS\_TQTFSBSig | true @ \pre  ResumeTaskS\_TQT
\end{theorem}

\begin{zproof}[ResumeTaskS\_TQT\_vc\_ref]
use ResumeTaskS\_TQ\_vc\_ref;
with disabled (TaskQueue) prove by reduce;
instantiate st\_\_0 == st;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(target?, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
with disabled (TaskData, PrioData, ContextData, Queue) prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
instantiate e\_\_0 == e;
prove;
\end{zproof}

\begin{zed}
ResumeTask\_TQT \defs ResumeTaskN\_TQT \lor  ResumeTaskS\_TQT
\end{zed}

\begin{zed}
ChangeTaskPriorityN\_TQT \defs ExtendTaskQueueXi \land  ChangeTaskPriorityN\_TQ
\end{zed}

\begin{zed}
ChangeTaskPriorityN\_TQTFSBSig \defs TaskQueueTime \land  ChangeTaskPriorityN\_TQFSBSig
\end{zed}

\begin{theorem}{ChangeTaskPriorityN\_TQT\_vc\_ref}
\forall  ChangeTaskPriorityN\_TQTFSBSig | true @ \pre  ChangeTaskPriorityN\_TQT
\end{theorem}

\begin{zproof}[ChangeTaskPriorityN\_TQT\_vc\_ref]
with enabled (applyOverride) prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
instantiate t\_\_0 == pt;
with normalization rewrite;
\end{zproof}

\begin{zed}
ChangeTaskPriorityS\_TQT \defs ExtendTaskQueueXi \land  ChangeTaskPriorityS\_TQ
\end{zed}

\begin{zed}
ChangeTaskPriorityS\_TQTFSBSig \defs TaskQueueTime \land  ChangeTaskPriorityS\_TQFSBSig
\end{zed}

\begin{theorem}{ChangeTaskPriorityS\_TQT\_vc\_ref}
\forall  ChangeTaskPriorityS\_TQTFSBSig | true @ \pre  ChangeTaskPriorityS\_TQT
\end{theorem}

\begin{zproof}[ChangeTaskPriorityS\_TQT\_vc\_ref]
use ChangeTaskPriorityS\_TQ\_vc\_ref;
with disabled (TaskQueue) prove by reduce;
instantiate st\_\_0 == st;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(target?, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
with disabled (TaskData, PrioData, ContextData, Queue) prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
instantiate e\_\_0 == e;
prove;
\end{zproof}

\begin{zed}
ChangeTaskPriorityD\_TQT \defs ExtendTaskQueueXi \land  ChangeTaskPriorityD\_TQ
\end{zed}

\begin{zed}
ChangeTaskPriorityD\_TQTFSBSig \defs TaskQueueTime \land  ChangeTaskPriorityD\_TQFSBSig
\end{zed}

\begin{theorem}{lChangeTaskPriorityD\_TQT\_Lemma}
\forall  TaskQueueTime; target?, topReady!: TASK; newpri?: \nat  | state(target?) = running \land  (target? = idle \implies  newpri? = 0) \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  newpri? < priority(topReady!) @ \lnot  (TaskQueueTime[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), priority := priority \oplus  \{(target?, newpri?)\}, running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})] \land  newpri? < priority(topReady!) \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lChangeTaskPriorityD\_TQT\_Lemma]
use lChangeTaskPriorityD\_TQ\_Lemma;
with disabled (TaskQueue) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
prove;
with disabled (TaskData, PrioData, ContextData, Queue) reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
instantiate rtsk\_\_0 == t;
with enabled (applyOverride) prove;
\end{zproof}

\begin{theorem}{ChangeTaskPriorityD\_TQT\_vc\_ref}
\forall  ChangeTaskPriorityD\_TQTFSBSig | true @ \pre  ChangeTaskPriorityD\_TQT
\end{theorem}

\begin{zproof}[ChangeTaskPriorityD\_TQT\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTime) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lChangeTaskPriorityD\_TQT\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == readyTask;
instantiate t\_\_0 == rtsk;
instantiate t\_\_0 == t;
prove;
\end{zproof}

\begin{zed}
CreateQueue\_TQT \defs ExtendTaskQueueXi \land  CreateQueue\_TQ
\end{zed}

\begin{zed}
CreateQueue\_TQTFSBSig \defs TaskQueueTime \land  CreateQueue\_TQFSBSig
\end{zed}

\begin{theorem}{CreateQueue\_TQT\_vc\_ref}
\forall  CreateQueue\_TQTFSBSig | true @ \pre  CreateQueue\_TQT
\end{theorem}

\begin{zproof}[CreateQueue\_TQT\_vc\_ref]
 use CreateQueue\_TQ\_vc\_ref;
with disabled (TaskQueue) prove by reduce;
\end{zproof}

\begin{zed}
DeleteQueue\_TQT \defs ExtendTaskQueueXi \land  DeleteQueue\_TQ
\end{zed}

\begin{zed}
DeleteQueue\_TQTFSBSig \defs TaskQueueTime \land  DeleteQueue\_TQFSBSig
\end{zed}

\begin{theorem}{DeleteQueue\_TQT\_vc\_ref}
\forall  DeleteQueue\_TQTFSBSig | true @ \pre  DeleteQueue\_TQT
\end{theorem}

\begin{zproof}[DeleteQueue\_TQT\_vc\_ref]
 use DeleteQueue\_TQ\_vc\_ref;
with disabled (TaskQueue) prove by reduce;
\end{zproof}

\begin{zed}
QueueSendN\_TQT \defs ExtendTaskQueueXi \land  QueueSendN\_TQ
\end{zed}

\begin{zed}
QueueSendN\_TQTFSBSig \defs TaskQueueTime \land  QueueSendN\_TQFSBSig
\end{zed}

\begin{theorem}{QueueSendN\_TQT\_vc\_ref}
\forall  QueueSendN\_TQTFSBSig | true @ \pre  QueueSendN\_TQT
\end{theorem}

\begin{zproof}[QueueSendN\_TQT\_vc\_ref]
use QueueSendN\_TQ\_vc\_ref;
with disabled (TaskQueue) prove by reduce;
\end{zproof}

\begin{schema}{QueueSendF\_TQT}
  \Delta TaskQueueTime\\
  QueueSendF\_TQ\\
  n?: \nat 
\where
  n? > clock\\
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = time \oplus  \{(running\_task \mapsto  n?)\}\\
  time\_slice' = time\_slice
\end{schema}

\begin{schema}{QueueSendF\_TQTFSBSig}
  TaskQueueTime\\
  QueueSendF\_TQFSBSig\\
  n?: \nat 
\where
  n? > clock
\end{schema}

\begin{theorem}{lQueueSendF\_TQT\_Lemma}
\forall  TaskQueueTime; topReady!: TASK; que?: QUEUE; n?: \nat  | running\_task \notin  \dom  release\_rcv \land  (running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)) \land  que? \in  queue \land  q\_size(que?) = q\_max(que?) \land  running\_task \neq  idle \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  n? > clock @ \lnot  (TaskQueueTime[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), release\_snd := \{running\_task\} \ndres  release\_snd, running\_task := topReady!, state := state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\}), time := time \oplus  \{(running\_task, n?)\}, wait\_snd := wait\_snd \oplus  \{(running\_task, que?)\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lQueueSendF\_TQT\_Lemma]
use lQueueSendF\_TQ\_Lemma;
with disabled (TaskQueue, partitionDef) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
apply partitionDef to predicate \langle delayed\_task\rangle  \cat  (\langle \{running\_task\} \cup  \dom  wait\_snd\rangle  \cat  \langle \dom  wait\_rcv\rangle ) \partition  \{running\_task\} \cup  \dom  time;
with disabled (partitionDef) with enabled (disjointCat) prove;
cases;
invoke TaskQueue;
invoke Task;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate e\_\_0 == e;
instantiate x\_\_0 == e;
prove;
next;
invoke TaskQueue;
invoke Task;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate \dom  wait\_rcv \cap  (\{running\_task\} \cup  \dom  wait\_snd) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == x;
prove;
next;
invoke TaskQueue;
invoke Task;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate delayed\_task \cap  (\{running\_task\} \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd)) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate x\_\_1 == x;
instantiate e == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\{running\_task\} \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd)) = \{running\_task\} \cup  \dom  time;
prove;
next;
instantiate t\_\_1 == t\_\_0;
apply applyOverride to expression (time \oplus  \{(running\_task, n?)\}) t\_\_0;
split t\_\_0 = running\_task;
prove;
next;
instantiate rtsk\_\_0 == t;
prove;
next;
\end{zproof}

\begin{theorem}{QueueSendF\_TQT\_vc\_ref}
\forall  QueueSendF\_TQTFSBSig | true @ \pre  QueueSendF\_TQT
\end{theorem}

\begin{zproof}[QueueSendF\_TQT\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTime) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lQueueSendF\_TQT\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
with normalization rewrite;
\end{zproof}

\begin{schema}{QueueSendW\_TQT}
  \Delta TaskQueueTime\\
  QueueSendW\_TQ
\where
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = \{topReady!\} \ndres  time\\
  time\_slice' = time\_slice
\end{schema}

\begin{zed}
QueueSendW\_TQTFSBSig \defs TaskQueueTime \land  QueueSendW\_TQFSBSig
\end{zed}

\begin{theorem}{lQueueSendW\_TQT\_Lemma}
\forall  TaskQueueTime; topReady!: TASK; que?: QUEUE | running\_task \notin  \dom  release\_rcv \land  (running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)) \land  que? \in  queue \land  q\_size(que?) < q\_max(que?) \land  topReady! \in  wait\_rcv \inv  \limg  \{que?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(running\_task) \geq  priority(topReady!) @ \lnot  (TaskQueueTime[q\_size := q\_size \oplus  \{(que?, (1 + q\_size(que?)))\}, release\_rcv := release\_rcv \oplus  \{(topReady!, que?)\}, release\_snd := \{running\_task\} \ndres  release\_snd, state := state \oplus  \{(topReady!, ready)\}, time := \{topReady!\} \ndres  time, wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  priority(topReady!) \leq  priority(running\_task) \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topReady!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topReady!, ready)\}) st) \in  transition) \implies  wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = que? \land  \lnot  priority(topReady!) \geq  priority(wr))
\end{theorem}

\begin{zproof}[lQueueSendW\_TQT\_Lemma]
use lQueueSendW\_TQ\_Lemma;
with disabled (TaskQueue, partitionDef) prove by reduce;
instantiate wrct\_\_0 == wrct;
apply partitionDef to predicate \langle delayed\_task\rangle  \cat  (\langle \dom  wait\_snd\rangle  \cat  \langle (\dom  wait\_rcv \setminus  \{topReady!\})\rangle ) \partition  \dom  time \setminus  \{topReady!\};
with disabled (partitionDef) with enabled (disjointCat) prove;
cases;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  \{(topReady!, ready)\}) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x == topReady!;
instantiate e\_\_0 == e;
rewrite;
next;
apply extensionality to predicate \dom  wait\_snd \cap  (\dom  wait\_rcv \setminus  \{topReady!\}) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topReady!\})) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topReady!\})) = \dom  time \setminus  \{topReady!\};
with enabled (disjointCat) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
split x \in  delayed\_task;
prove;
split x \in  \dom  wait\_snd;
prove;
next;
instantiate t\_\_0 == t;
prove;
next;
instantiate wrct\_\_0 == wr;
prove;
next;
\end{zproof}

\begin{theorem}{QueueSendW\_TQT\_vc\_ref}
\forall  QueueSendW\_TQTFSBSig | true @ \pre  QueueSendW\_TQT
\end{theorem}

\begin{zproof}[QueueSendW\_TQT\_vc\_ref]
use findDelegate[a := wait\_rcv \inv  \limg  \{que?\} \rimg , g := priority];
with disabled (TaskQueueTime) prove by reduce;
instantiate topReady! == f (wait\_rcv \inv  \limg  \{que?\} \rimg );
prove;
use lQueueSendW\_TQT\_Lemma[topReady! := f (wait\_rcv \inv  \limg  \{que?\} \rimg )];
prove;
instantiate wr\_\_0 == f (wait\_rcv \inv  \limg  \{que?\} \rimg );
instantiate t == wrct;
with normalization rewrite;
\end{zproof}

\begin{schema}{QueueSendWS\_TQT}
  \Delta TaskQueueTime\\
  QueueSendWS\_TQ
\where
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = \{topReady!\} \ndres  time\\
  time\_slice' = time\_slice
\end{schema}

\begin{zed}
QueueSendWS\_TQTFSBSig \defs TaskQueueTime \land  QueueSendWS\_TQFSBSig
\end{zed}

\begin{theorem}{lQueueSendWS\_TQT\_Lemma}
\forall  TaskQueueTime; topReady!: TASK; que?: QUEUE | running\_task \notin  \dom  release\_rcv \land  (running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)) \land  que? \in  queue \land  q\_size(que?) < q\_max(que?) \land  topReady! \in  wait\_rcv \inv  \limg  \{que?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(topReady!) > priority(running\_task) @ \lnot  (TaskQueueTime[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), q\_size := q\_size \oplus  \{(wait\_rcv(topReady!), (1 + q\_size (wait\_rcv(topReady!))))\}, release\_rcv := release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\}, release\_snd := \{running\_task\} \ndres  release\_snd, running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\}), time := \{topReady!\} \ndres  time, wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = wait\_rcv(topReady!) \land  \lnot  priority(topReady!) \geq  priority(wr))
\end{theorem}

\begin{zproof}[lQueueSendWS\_TQT\_Lemma]
use lQueueSendWS\_TQ\_Lemma;
with disabled (TaskQueue, partitionDef) prove by reduce;
instantiate wrct\_\_0 == wrct;
apply partitionDef to predicate \langle delayed\_task\rangle  \cat  (\langle \dom  wait\_snd\rangle  \cat  \langle (\dom  wait\_rcv \setminus  \{topReady!\})\rangle ) \partition  \dom  time \setminus  \{topReady!\};
with disabled (partitionDef) with enabled (disjointCat) prove;
cases;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate e\_\_0 == e;
instantiate x == e;
invoke TaskQueue;
invoke Task;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
prove;
next;
apply extensionality to predicate \dom  wait\_snd \cap  (\dom  wait\_rcv \setminus  \{topReady!\}) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topReady!\})) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topReady!\})) = \dom  time \setminus  \{topReady!\};
with enabled (disjointCat) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
split x \in  delayed\_task;
prove;
split x \in  \dom  wait\_snd;
prove;
next;
instantiate t\_\_0 == t;
prove;
next;
instantiate wrct\_\_0 == wr;
prove;
next;
\end{zproof}

\begin{theorem}{QueueSendWS\_TQT\_vc\_ref}
\forall  QueueSendWS\_TQTFSBSig | true @ \pre  QueueSendWS\_TQT
\end{theorem}

\begin{zproof}[QueueSendWS\_TQT\_vc\_ref]
with disabled (TaskQueueTime) prove by reduce;
instantiate running\_task' == topReady!;
prove;
use lQueueSendWS\_TQT\_Lemma;
prove;
instantiate wr\_\_0 == wrct;
prove;
with normalization rewrite;
\end{zproof}

\begin{zed}
QueueSend\_TQT \defs QueueSendN\_TQT \lor  QueueSendF\_TQT \lor  QueueSendW\_TQT \lor  QueueSendWS\_TQT
\end{zed}

\begin{zed}
QueueReceiveN\_TQT \defs ExtendTaskQueueXi \land  QueueReceiveN\_TQ
\end{zed}

\begin{zed}
QueueReceiveN\_TQTFSBSig \defs TaskQueueTime \land  QueueReceiveN\_TQFSBSig
\end{zed}

\begin{theorem}{QueueReceiveN\_TQT\_vc\_ref}
\forall  QueueReceiveN\_TQTFSBSig | true @ \pre  QueueReceiveN\_TQT
\end{theorem}

\begin{zproof}[QueueReceiveN\_TQT\_vc\_ref]
use QueueReceiveN\_TQ\_vc\_ref;
with disabled (TaskQueue) prove by reduce;
\end{zproof}

\begin{schema}{QueueReceiveE\_TQT}
  \Delta TaskQueueTime\\
  QueueReceiveE\_TQ\\
  n?: \nat 
\where
  n? > clock\\
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = time \oplus  \{(running\_task \mapsto  n?)\}\\
  time\_slice' = time\_slice
\end{schema}

\begin{schema}{QueueReceiveE\_TQTFSBSig}
  TaskQueueTime\\
  QueueReceiveE\_TQFSBSig\\
  n?: \nat 
\where
  n? > clock
\end{schema}

\begin{theorem}{lQueueReceiveE\_TQT\_Lemma}
\forall  TaskQueueTime; que?: QUEUE; topReady!: TASK; n?: \nat  | running\_task \notin  \dom  release\_snd \land  (running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)) \land  que? \in  queue \land  q\_size(que?) = 0 \land  running\_task \neq  idle \land  topReady! \in  state \inv  \limg  \{ready\} \rimg  \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  n? > clock @ \lnot  (TaskQueueTime[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), release\_rcv := \{running\_task\} \ndres  release\_rcv, running\_task := topReady!, state := state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\}), time := time \oplus  \{(running\_task, n?)\}, wait\_rcv := wait\_rcv \oplus  \{(running\_task, que?)\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lQueueReceiveE\_TQT\_Lemma]
use lQueueReceiveE\_TQ\_Lemma;
with disabled (TaskQueue, partitionDef) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
apply partitionDef to predicate \langle delayed\_task\rangle  \cat  (\langle \dom  wait\_snd\rangle  \cat  \langle (\{running\_task\} \cup  \dom  wait\_rcv)\rangle ) \partition  \{running\_task\} \cup  \dom  time;
with disabled (partitionDef) with enabled (disjointCat) prove;
cases;
invoke TaskQueue;
invoke Task;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
invoke TaskQueue;
invoke Task;
apply extensionality to predicate \dom  wait\_snd \cap  (\{running\_task\} \cup  \dom  wait\_rcv) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
instantiate x\_\_1 == x;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == x;
prove;
next;
invoke TaskQueue;
invoke Task;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply extensionality to predicate delayed\_task \cap  (\{running\_task\} \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd)) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\{running\_task\} \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd)) = \{running\_task\} \cup  \dom  time;
prove;
next;
instantiate t\_\_1 == t\_\_0;
apply applyOverride to expression (time \oplus  \{(running\_task, n?)\}) t\_\_0;
split t\_\_0 = running\_task;
prove;
next;
instantiate rtsk\_\_0 == t;
prove;
next;
\end{zproof}

\begin{theorem}{QueueReceiveE\_TQT\_vc\_ref}
\forall  QueueReceiveE\_TQTFSBSig | true @ \pre  QueueReceiveE\_TQT
\end{theorem}

\begin{zproof}[QueueReceiveE\_TQT\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTime) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lQueueReceiveE\_TQT\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
with normalization rewrite;
\end{zproof}

\begin{schema}{QueueReceiveW\_TQT}
  \Delta TaskQueueTime\\
  QueueReceiveW\_TQ
\where
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = \{topReady!\} \ndres  time\\
  time\_slice' = time\_slice
\end{schema}

\begin{zed}
QueueReceiveW\_TQTFSBSig \defs TaskQueueTime \land  QueueReceiveW\_TQFSBSig
\end{zed}

\begin{theorem}{lQueueReceiveW\_TQT\_Lemma}
\forall  TaskQueueTime; que?: QUEUE; topReady!: TASK | running\_task \notin  \dom  release\_snd \land  (running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)) \land  que? \in  queue \land  q\_size(que?) > 0 \land  topReady! \in  wait\_snd \inv  \limg  \{que?\} \rimg  \land  (\forall  wsnt: wait\_snd \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wsnt)) \land  priority(running\_task) \geq  priority(topReady!) @ \lnot  (TaskQueueTime[q\_size := q\_size \oplus  \{(que?, (q\_size(que?) - 1))\}, release\_rcv := \{running\_task\} \ndres  release\_rcv, release\_snd := release\_snd \oplus  \{(topReady!, que?)\}, state := state \oplus  \{(topReady!, ready)\}, time := \{topReady!\} \ndres  time, wait\_snd := \{topReady!\} \ndres  wait\_snd] \land  priority(topReady!) \leq  priority(running\_task) \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topReady!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topReady!, ready)\}) st) \in  transition) \implies  ws \in  \dom  wait\_snd \land  wait\_snd(ws) = que? \land  \lnot  priority(topReady!) \geq  priority(ws))
\end{theorem}

\begin{zproof}[lQueueReceiveW\_TQT\_Lemma]
use lQueueReceiveW\_TQ\_Lemma;
with disabled (TaskQueue, partitionDef) prove by reduce;
instantiate wsnt\_\_0 == wsnt;
apply partitionDef to predicate \langle delayed\_task\rangle  \cat  (\langle \dom  wait\_snd \setminus  \{topReady!\}\rangle  \cat  \langle \dom  wait\_rcv\rangle ) \partition  \dom  time \setminus  \{topReady!\};
with disabled (partitionDef) with enabled (disjointCat) prove;
cases;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  \{(topReady!, ready)\}) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x == e;
instantiate e\_\_0 == e;
prove;
next;
apply extensionality to predicate \dom  wait\_rcv \cap  (\dom  wait\_snd \setminus  \{topReady!\}) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  (\dom  wait\_snd \setminus  \{topReady!\})) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\dom  wait\_rcv \cup  (\dom  wait\_snd \setminus  \{topReady!\})) = \dom  time \setminus  \{topReady!\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
split x \in  delayed\_task;
prove;
split x \in  \dom  wait\_rcv;
prove;
next;
instantiate t\_\_0 == t;
prove;
next;
instantiate wsnt\_\_0 == ws;
prove;
next;
\end{zproof}

\begin{theorem}{QueueReceiveW\_TQT\_vc\_ref}
\forall  QueueReceiveW\_TQTFSBSig | true @ \pre  QueueReceiveW\_TQT
\end{theorem}

\begin{zproof}[QueueReceiveW\_TQT\_vc\_ref]
use findDelegate[a := wait\_snd \inv  \limg  \{que?\} \rimg , g := priority];
with disabled (TaskQueueTime) prove by reduce;
instantiate topReady! == f (wait\_snd \inv  \limg  \{que?\} \rimg );
prove;
use lQueueReceiveW\_TQT\_Lemma[topReady! := f (wait\_snd \inv  \limg  \{que?\} \rimg )];
prove;
instantiate ws\_\_0 == f (wait\_snd \inv  \limg  \{que?\} \rimg );
instantiate t == wsnt;
with normalization rewrite;
\end{zproof}

\begin{schema}{QueueReceiveWS\_TQT}
  \Delta TaskQueueTime\\
  QueueReceiveWS\_TQ
\where
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = \{topReady!\} \ndres  time\\
  time\_slice' = time\_slice
\end{schema}

\begin{zed}
QueueReceiveWS\_TQTFSBSig \defs TaskQueueTime \land  QueueReceiveWS\_TQFSBSig
\end{zed}

\begin{theorem}{lQueueReceiveWS\_TQT\_Lemma}
\forall  TaskQueueTime; que?: QUEUE; topReady!: TASK | running\_task \notin  \dom  release\_snd \land  (running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)) \land  que? \in  queue \land  q\_size(que?) > 0 \land  topReady! \in  wait\_snd \inv  \limg  \{que?\} \rimg  \land  (\forall  wsnt: wait\_snd \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wsnt)) \land  priority(topReady!) > priority(running\_task) @ \lnot  (TaskQueueTime[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), q\_size := q\_size \oplus  \{(wait\_snd(topReady!), (q\_size (wait\_snd(topReady!)) - 1))\}, release\_rcv := \{running\_task\} \ndres  release\_rcv, release\_snd := release\_snd \oplus  \{(topReady!, wait\_snd(topReady!))\}, running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\}), time := \{topReady!\} \ndres  time, wait\_snd := \{topReady!\} \ndres  wait\_snd] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  ws \in  \dom  wait\_snd \land  wait\_snd(ws) = wait\_snd(topReady!) \land  \lnot  priority(topReady!) \geq  priority(ws))
\end{theorem}

\begin{zproof}[lQueueReceiveWS\_TQT\_Lemma]
use lQueueReceiveWS\_TQ\_Lemma;
with disabled (TaskQueue, partitionDef) prove by reduce;
apply partitionDef to predicate \langle delayed\_task\rangle  \cat  (\langle \dom  wait\_snd \setminus  \{topReady!\}\rangle  \cat  \langle \dom  wait\_rcv\rangle ) \partition  \dom  time \setminus  \{topReady!\};
instantiate wsnt\_\_0 == wsnt;
with disabled (partitionDef) with enabled (disjointCat) prove;
cases;
invoke TaskQueue;
invoke Task;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
with enabled (disjointCat) prove;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_0 == e;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == e;
prove;
next;
apply extensionality to predicate \dom  wait\_rcv \cap  (\dom  wait\_snd \setminus  \{topReady!\}) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  (\dom  wait\_snd \setminus  \{topReady!\})) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\dom  wait\_rcv \cup  (\dom  wait\_snd \setminus  \{topReady!\})) = \dom  time \setminus  \{topReady!\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
split x \in  delayed\_task;
prove;
split x \in  \dom  wait\_rcv;
prove;
next;
instantiate t\_\_0 == t;
prove;
next;
instantiate wsnt\_\_0 == ws;
prove;
next;
\end{zproof}

\begin{theorem}{QueueReceiveWS\_TQT\_vc\_ref}
\forall  QueueReceiveWS\_TQTFSBSig | true @ \pre  QueueReceiveWS\_TQT
\end{theorem}

\begin{zproof}[QueueReceiveWS\_TQT\_vc\_ref]
with disabled (TaskQueueTime) prove by reduce;
instantiate running\_task' == topReady!;
prove;
use lQueueReceiveWS\_TQT\_Lemma;
prove;
instantiate ws\_\_0 == wsnt;
prove;
with normalization rewrite;
\end{zproof}

\begin{zed}
QueueReceive\_TQT \defs QueueReceiveN\_TQT \lor  QueueReceiveE\_TQT \lor  QueueReceiveW\_TQT \lor  QueueReceiveWS\_TQT
\end{zed}

\begin{schema}{DelayUntil\_TQT}
  \Delta TaskQueueTime\\
  n?: \nat \\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  state(topReady!) = ready\\
  running\_task \neq  idle\\
  \forall  t: TASK | state(t) = ready @ priority(topReady!) \geq  priority(t)\\
  n? > clock\\
  \exists  st?: STATE | st? = blocked @ Reschedule[topReady!/target?, tasks/tasks?, priority/pri?]\\
  \Xi Queue\\
  clock' = clock\\
  delayed\_task' = delayed\_task \cup  \{running\_task\}\\
  time' = time \oplus  \{(running\_task \mapsto  n?)\}\\
  time\_slice' = time\_slice
\end{schema}

\begin{schema}{DelayUntil\_TQTFSBSig}
  TaskQueueTime\\
  n?: \nat 
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  running\_task \neq  idle\\
  n? > clock
\end{schema}

\begin{theorem}{lDelayUntil\_TQT\_Lemma}
\forall  TaskQueueTime; n?: \nat ; topReady!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  running\_task \neq  idle \land  state(topReady!) = ready \land  n? > clock \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (TaskQueueTime[delayed\_task := delayed\_task \cup  \{running\_task\}, log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\}), time := time \oplus  \{(running\_task, n?)\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lDelayUntil\_TQT\_Lemma]
with disabled (partitionDef) prove by reduce;
apply partitionDef to predicate \langle delayed\_task \cup  (state \inv  \limg  \{running\} \rimg )\rangle  \cat  (\langle \dom  wait\_snd\rangle  \cat  \langle \dom  wait\_rcv\rangle ) \partition  \dom  time \cup  (state \inv  \limg  \{running\} \rimg );
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
with disabled (partitionDef) with enabled (disjointCat) prove;
cases;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate e\_\_0 == e;
instantiate x\_\_0 == e;
prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{running\_task\} \cup  (\{topReady!\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg )));
prove;
with normalization rewrite;
next;
apply extensionality to predicate (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
instantiate x\_\_0 == x;
apply applyOverride to expression (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) x;
prove;
with normalization rewrite;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
apply extensionality to predicate (delayed\_task \cup  (state \inv  \limg  \{running\} \rimg )) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == x;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_0 == x;
instantiate e\_\_1 == x;
split x \in  delayed\_task;
prove;
next;
apply extensionality to predicate delayed\_task \cup  ((state \inv  \limg  \{running\} \rimg ) \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd)) = \dom  time \cup  (state \inv  \limg  \{running\} \rimg );
prove;
split y \in  \dom  wait\_snd;
prove;
next;
with enabled (applyOverride) prove;
next;
instantiate rtsk == pt;
with enabled (applyOverride) prove;
split pt = running\_task;
prove;
next;
instantiate t\_\_1 == t\_\_0;
instantiate x == t;
apply applyOverride to expression (time \oplus  \{(running\_task, n?)\}) t;
split t \in  \dom  time;
with disabled (partitionDef) prove;
next;
apply applyOverride to expression (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st;
prove;
with normalization rewrite;
next;
instantiate rtsk == t;
prove;
next;
\end{zproof}

\begin{theorem}{DelayUntil\_TQT\_vc\_ref}
\forall  DelayUntil\_TQTFSBSig | true @ \pre  DelayUntil\_TQT
\end{theorem}

\begin{zproof}[DelayUntil\_TQT\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTime) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lDelayUntil\_TQT\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
\end{zproof}

\begin{schema}{CheckDelayedTaskN\_TQT}
  \Delta TaskQueueTime\\
  topWaiting!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  topWaiting! \in  \dom  time\\
  \forall  wt: \dom  time @ time(topWaiting!) \leq  time(wt)\\
  \forall  wt: \dom  time | time(wt) = time(topWaiting!) @ priority(topWaiting!) \geq  priority(wt)\\
  priority(topWaiting!) \leq  priority(running\_task)\\
  \Xi TaskData\\
  state' = state \oplus  \{(topWaiting! \mapsto  ready)\}\\
  \Xi ContextData\\
  \Xi PrioData\\
  \Xi QueueData\\
  wait\_snd' = \{topWaiting!\} \ndres  wait\_snd\\
  wait\_rcv' = \{topWaiting!\} \ndres  wait\_rcv\\
  \Xi QReleasingData\\
  clock' = time(topWaiting!)\\
  delayed\_task' = delayed\_task \setminus  \{topWaiting!\}\\
  time' = \{topWaiting!\} \ndres  time\\
  time\_slice' = time\_slice
\end{schema}

\begin{zproof}[CheckDelayedTaskN\_TQT\$domainCheck]
prove;
\end{zproof}

\begin{schema}{CheckDelayedTaskN\_TQTFSBSig}
  TaskQueueTime
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  \exists  topWaiting!: \dom  time @ (\forall  wt: \dom  time @ time(topWaiting!) \leq  time(wt)) \land  (\forall  wt: \dom  time | time(wt) = time(topWaiting!) @ priority(topWaiting!) \geq  priority(wt)) \land  priority(topWaiting!) \leq  priority(running\_task)
\end{schema}

\begin{zproof}[CheckDelayedTaskN\_TQTFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{lCheckDelayedTaskN\_TQT\_Lemma}
\forall  TaskQueueTime; topWaiting!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  topWaiting! \in  \dom  time \land  (\forall  dtk: \dom  time @ time(topWaiting!) \leq  time(dtk)) \land  (\forall  detk: \dom  time | time(detk) = time(topWaiting!) @ priority(topWaiting!) \geq  priority(detk)) \land  priority(topWaiting!) \leq  priority(running\_task) @ \lnot  (TaskQueueTime[clock := time(topWaiting!), delayed\_task := delayed\_task \setminus  \{topWaiting!\}, state := state \oplus  \{(topWaiting!, ready)\}, time := \{topWaiting!\} \ndres  time, wait\_rcv := \{topWaiting!\} \ndres  wait\_rcv, wait\_snd := \{topWaiting!\} \ndres  wait\_snd] \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topWaiting!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topWaiting!, ready)\}) st) \in  transition) \land  (wt \in  \dom  time \implies  time(topWaiting!) \leq  time(wt)) \implies  wt\_\_0 \in  \dom  time \land  time(wt\_\_0) = time(topWaiting!) \land  \lnot  priority(topWaiting!) \geq  priority(wt\_\_0))
\end{theorem}

\begin{zproof}[lCheckDelayedTaskN\_TQT\_Lemma]
use domTime[t := topWaiting!];
with disabled (partitionDef) prove by reduce;
apply partitionDef to predicate \langle delayed\_task \setminus  \{topWaiting!\}\rangle  \cat  (\langle \dom  wait\_snd \setminus  \{topWaiting!\}\rangle  \cat  \langle (\dom  wait\_rcv \setminus  \{topWaiting!\})\rangle ) \partition  \dom  time \setminus  \{topWaiting!\};
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topWaiting!\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ));
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := time, a := topWaiting!];
with disabled (partitionDef) with enabled (disjointCat, applyOverride) prove;
cases;
apply inPower to predicate delayed\_task \in  \power  (\{topWaiting!\} \cup  ((state \oplus  \{(topWaiting!, ready)\}) \inv  \limg  \{blocked\} \rimg ));
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
apply extensionality to predicate (\dom  wait\_rcv \setminus  \{topWaiting!\}) \cap  (\dom  wait\_snd \setminus  \{topWaiting!\}) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply inPower to predicate \ran  (\{topWaiting!\} \ndres  wait\_snd) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  wait\_snd \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
with enabled (inRan) prove;
instantiate x\_\_2 == x;
prove;
next;
apply inPower to predicate \ran  (\{topWaiting!\} \ndres  wait\_rcv) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  wait\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
with enabled (inRan) prove;
instantiate x\_\_2 == x;
prove;
next;
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \setminus  \{topWaiting!\} \cup  (\dom  wait\_snd \setminus  \{topWaiting!\})) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_1 == x;
instantiate x\_\_2 == x;
prove;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  (\{topWaiting!\} \cup  ((state \oplus  \{(topWaiting!, ready)\}) \inv  \limg  \{blocked\} \rimg ));
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  (\{topWaiting!\} \cup  ((state \oplus  \{(topWaiting!, ready)\}) \inv  \limg  \{blocked\} \rimg ));
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
apply extensionality to predicate (delayed\_task \setminus  \{topWaiting!\}) \cap  (\dom  wait\_rcv \setminus  \{topWaiting!\} \cup  (\dom  wait\_snd \setminus  \{topWaiting!\})) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate delayed\_task \setminus  \{topWaiting!\} \cup  (\dom  wait\_rcv \setminus  \{topWaiting!\} \cup  (\dom  wait\_snd \setminus  \{topWaiting!\})) = \dom  time \setminus  \{topWaiting!\};
prove;
next;
with normalization rewrite;
next;
instantiate pt\_\_0 == pt;
apply applyOverride to expression (state \oplus  \{(topWaiting!, ready)\}) pt;
prove;
with normalization rewrite;
next;
instantiate dtk == t;
prove;
next;
invoke transition;
rewrite;
next;
instantiate dtk == wt;
prove;
next;
instantiate detk == wt\_\_0;
prove;
next;
\end{zproof}

\begin{theorem}{CheckDelayedTaskN\_TQT\_vc\_ref}
\forall  CheckDelayedTaskN\_TQTFSBSig | true @ \pre  CheckDelayedTaskN\_TQT
\end{theorem}

\begin{zproof}[CheckDelayedTaskN\_TQT\_vc\_ref]
with disabled (TaskQueueTime) prove by reduce;
instantiate topWaiting\_\_0! == topWaiting!;
prove;
use lCheckDelayedTaskN\_TQT\_Lemma;
prove;
instantiate wt\_\_1 == dtk;
instantiate wt\_\_2 == detk;
with normalization rewrite;
\end{zproof}

\begin{schema}{CheckDelayedTaskS\_TQT}
  \Delta TaskQueueTime\\
  topWaiting!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  topWaiting! \in  \dom  time\\
  \forall  wt: \dom  time @ time(topWaiting!) \leq  time(wt)\\
  \forall  wt: \dom  time | time(wt) = time(topWaiting!) @ priority(topWaiting!) \geq  priority(wt)\\
  priority(topWaiting!) > priority(running\_task)\\
  \exists  st?: STATE | st? = ready @ Reschedule[topWaiting!/target?, tasks/tasks?, priority/pri?]\\
  \Xi QueueData\\
  wait\_snd' = \{topWaiting!\} \ndres  wait\_snd\\
  wait\_rcv' = \{topWaiting!\} \ndres  wait\_rcv\\
  \Xi QReleasingData\\
  clock' = time(topWaiting!)\\
  delayed\_task' = delayed\_task \setminus  \{topWaiting!\}\\
  time' = \{topWaiting!\} \ndres  time\\
  time\_slice' = time\_slice
\end{schema}

\begin{zproof}[CheckDelayedTaskS\_TQT\$domainCheck]
prove;
\end{zproof}

\begin{schema}{CheckDelayedTaskS\_TQTFSBSig}
  TaskQueueTime
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  \exists  topWaiting!: \dom  time @ (\forall  wt: \dom  time @ time(topWaiting!) \leq  time(wt)) \land  (\forall  wt: \dom  time | time(wt) = time(topWaiting!) @ priority(topWaiting!) \geq  priority(wt)) \land  priority(topWaiting!) > priority(running\_task)
\end{schema}

\begin{zproof}[CheckDelayedTaskS\_TQTFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{lCheckDelayedTaskS\_TQT\_Lemma}
\forall  TaskQueueTime; topWaiting!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  topWaiting! \in  \dom  time \land  (\forall  dtk: \dom  time @ time(topWaiting!) \leq  time(dtk)) \land  (\forall  detk: \dom  time | time(detk) = time(topWaiting!) @ priority(topWaiting!) \geq  priority(detk)) \land  priority(topWaiting!) > priority(running\_task) @ \lnot  (TaskQueueTime[clock := time(topWaiting!), delayed\_task := delayed\_task \setminus  \{topWaiting!\}, log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topWaiting!), running\_task := topWaiting!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\}), time := \{topWaiting!\} \ndres  time, wait\_rcv := \{topWaiting!\} \ndres  wait\_rcv, wait\_snd := \{topWaiting!\} \ndres  wait\_snd] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) st) \in  transition) \land  (wt \in  \dom  time \implies  time(topWaiting!) \leq  time(wt)) \implies  wt\_\_0 \in  \dom  time \land  time(wt\_\_0) = time(topWaiting!) \land  \lnot  priority(topWaiting!) \geq  priority(wt\_\_0))
\end{theorem}

\begin{zproof}[lCheckDelayedTaskS\_TQT\_Lemma]
use domTime[t := topWaiting!];
with disabled (partitionDef) prove by reduce;
apply partitionDef to predicate \langle delayed\_task \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg )\rangle  \cat  (\langle \dom  wait\_snd \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg )\rangle  \cat  \langle (\dom  wait\_rcv \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ))\rangle ) \partition  \dom  time \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg );
with disabled (partitionDef) with enabled (disjointCat) prove;
cases;
apply inPower to predicate delayed\_task \in  \power  (\{topWaiting!\} \cup  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{blocked\} \rimg ));
with enabled (disjointCat) prove;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_0 == e;
prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topWaiting!\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) \cup  (state \inv  \limg  \{running\} \rimg ));
prove;
with normalization rewrite;
next;
apply extensionality to predicate (state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg  = \{topWaiting!\};
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
prove;
instantiate x\_\_0 == x;
apply applyOverride to expression (state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) x;
with normalization prove;
next;
apply extensionality to predicate (\dom  wait\_rcv \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg )) \cap  (\dom  wait\_snd \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_0 == x;
rewrite;
next;
apply inPower to predicate \ran  (((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \ndres  wait\_snd) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  wait\_snd \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
with enabled (inRan) prove;
instantiate x\_\_0 == x;
prove;
next;
apply inPower to predicate \ran  (((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \ndres  wait\_rcv) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  wait\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
with enabled (inRan) prove;
instantiate x\_\_0 == x;
prove;
next;
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  (\dom  wait\_snd \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ))) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_0 == x;
prove;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  (((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{blocked\} \rimg ) \cup  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ));
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
with enabled (disjointCat) prove;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_0 == e;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == e;
with enabled (applyOverride) prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  (((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{blocked\} \rimg ) \cup  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ));
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
with enabled (disjointCat) prove;
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_0 == e;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == e;
with enabled (applyOverride) prove;
next;
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := time, a := topWaiting!];
prove;
next;
instantiate t\_\_0 == topWaiting!;
prove;
next;
apply extensionality to predicate (delayed\_task \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg )) \cap  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  (\dom  wait\_snd \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ))) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate delayed\_task \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  (\dom  wait\_snd \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ))) = \dom  time \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg );
prove;
next;
with enabled (applyOverride) prove;
split idle = running\_task;
prove;
next;
instantiate pt\_\_0 == pt;
split pt \in  TASK;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate dtk == t;
prove;
next;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
instantiate x == st;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate dtk == wt;
prove;
next;
instantiate detk == wt\_\_0;
prove;
next;
\end{zproof}

\begin{theorem}{CheckDelayedTaskS\_TQT\_vc\_ref}
\forall  CheckDelayedTaskS\_TQTFSBSig | true @ \pre  CheckDelayedTaskS\_TQT
\end{theorem}

\begin{zproof}[CheckDelayedTaskS\_TQT\_vc\_ref]
with disabled (TaskQueueTime) prove by reduce;
instantiate running\_task' == topWaiting!;
prove;
use lCheckDelayedTaskS\_TQT\_Lemma;
prove;
instantiate wt\_\_1 == dtk;
instantiate wt\_\_2 == detk;
with normalization rewrite;
\end{zproof}

\begin{schema}{TimeSlicing\_TQT}
  \Delta TaskQueueTime\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  state(topReady!) = ready\\
  priority(topReady!) = priority(running\_task)\\
  \forall  t: \dom  time @ time\_slice \leq  time(t)\\
  \exists  st?: STATE | st? = ready @ Reschedule[topReady!/target?, tasks/tasks?, priority/pri?]\\
  \Xi Queue\\
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = time\\
  time\_slice' = time\_slice + slice\_delay
\end{schema}

\begin{zproof}[TimeSlicing\_TQT\$domainCheck]
 prove by reduce;
\end{zproof}

\begin{schema}{TimeSlicing\_TQTFSBSig}
  TaskQueueTime
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  \forall  t: \dom  time @ time\_slice \leq  time(t)\\
  \exists  topReady!: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) = priority(running\_task)
\end{schema}

\begin{zproof}[TimeSlicing\_TQTFSBSig\$domainCheck]
 prove by reduce;
\end{zproof}

\begin{theorem}{lTimeSlicing\_TQT\_Lemma}
\forall  TaskQueueTime; topReady!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  state(topReady!) = ready \land  priority(topReady!) = priority(running\_task) \land  (\forall  ts: \dom  time @ time\_slice \leq  time(ts)) @ \lnot  (TaskQueueTime[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\}), time\_slice := time\_slice + slice\_delay] \implies  st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \land  \lnot  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition)
\end{theorem}

\begin{zproof}[lTimeSlicing\_TQT\_Lemma]
prove by reduce;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{nonexistent\} \rimg );
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
prove;
cases;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
apply extensionality to predicate (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
instantiate x\_\_0 == x;
apply applyOverride to expression (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) x;
with normalization rewrite;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
prove;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_0 == e;
prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  ((state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
prove;
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_0 == e;
prove;
next;
use slice\_delay\_def;
prove;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate pt\_\_0 == pt;
use applyInRanFun[TASK, \nat ][f := priority, a := pt];
with enabled (applyOverride) prove;
with normalization rewrite;
next;
apply applyOverride to expression (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st;
prove;
with normalization rewrite;
next;
\end{zproof}

\begin{theorem}{TimeSlicing\_TQT\_vc\_ref}
\forall  TimeSlicing\_TQTFSBSig | true @ \pre  TimeSlicing\_TQT
\end{theorem}

\begin{zproof}[TimeSlicing\_TQT\_vc\_ref]
with disabled (TaskQueueTime) prove by reduce;
instantiate running\_task' == topReady!;
prove;
use lTimeSlicing\_TQT\_Lemma;
prove;
instantiate t == ts;
prove;
\end{zproof}

\begin{schema}{NoSlicing\_TQT}
  \Delta TaskQueueTime
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  \forall  t: \dom  time @ time\_slice \leq  time(t)\\
  \forall  t: state \inv  \limg  \{ready\} \rimg  @ priority(t) < priority(running\_task)\\
  \Xi Task\\
  \Xi Queue\\
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = time\\
  time\_slice' = time\_slice + slice\_delay
\end{schema}

\begin{zproof}[NoSlicing\_TQT\$domainCheck]
prove;
\end{zproof}

\begin{schema}{NoSlicing\_TQTFSBSig}
  TaskQueueTime
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  \forall  t: \dom  time @ time\_slice \leq  time(t)\\
  \forall  t: state \inv  \limg  \{ready\} \rimg  @ priority(t) < priority(running\_task)
\end{schema}

\begin{zproof}[NoSlicing\_TQTFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{NoSlicing\_TQT\_vc\_ref}
\forall  NoSlicing\_TQTFSBSig | true @ \pre  NoSlicing\_TQT
\end{theorem}

\begin{zproof}[NoSlicing\_TQT\_vc\_ref]
use slice\_delay\_def;
prove by reduce;
\end{zproof}

\begin{schema}{MutexData}
  semaphore: \power  QUEUE\\
  mutex: \power  QUEUE\\
  mutex\_holder: QUEUE \pfun  TASK\\
  mutex\_recursive: QUEUE \pfun  \nat 
\where
  mutex \cap  semaphore = \emptyset\\
  \dom  mutex\_recursive = mutex\\
  \forall  m: mutex @ m \notin  \dom  mutex\_holder \iff  mutex\_recursive(m) = 0
\end{schema}

\begin{zproof}[MutexData\$domainCheck]
prove;
\end{zproof}

\begin{schema}{Init\_MutexData}
  MutexData~'
\where
  semaphore' = \emptyset\\
  mutex' = \emptyset\\
  mutex\_holder' = \emptyset\\
  mutex\_recursive' = \emptyset
\end{schema}

\begin{theorem}{MutexDataInit}
\exists  MutexData~' @ Init\_MutexData
\end{theorem}

\begin{zproof}[MutexDataInit]
prove by reduce;
\end{zproof}

\begin{schema}{OriginalPrioData}
  base\_priority: TASK \pfun  \nat 
\end{schema}

\begin{schema}{Init\_OriginalPrioData}
  OriginalPrioData~'
\where
  base\_priority' = \emptyset
\end{schema}

\begin{theorem}{OriginalPrioDataInit}
\exists  OriginalPrioData~' @ Init\_OriginalPrioData
\end{theorem}

\begin{zproof}[OriginalPrioDataInit]
prove by reduce;
\end{zproof}

\begin{schema}{MReleasingData}
  release\_mutex: TASK \pfun  QUEUE
\end{schema}

\begin{schema}{Init\_MReleasingData}
  MReleasingData~'
\where
  release\_mutex' = \emptyset
\end{schema}

\begin{theorem}{MReleasingDataInit}
\exists  MReleasingData~' @ Init\_MReleasingData
\end{theorem}

\begin{zproof}[MReleasingDataInit]
prove by reduce;
\end{zproof}

\begin{schema}{Mutex}
  MutexData\\
  OriginalPrioData\\
  MReleasingData
\where
  \dom  base\_priority = \ran  mutex\_holder\\
  \ran  release\_mutex \subseteq  mutex
\end{schema}

\begin{schema}{Init\_Mutex}
  Mutex~'
\where
  Init\_MutexData\\
  Init\_OriginalPrioData\\
  Init\_MReleasingData
\end{schema}

\begin{theorem}{MutexInit}
\exists  Mutex~' @ Init\_Mutex
\end{theorem}

\begin{zproof}[MutexInit]
prove by reduce;
\end{zproof}

\begin{schema}{TaskQueueTimeMutex}
  TaskQueueTime\\
  Mutex
\where
  semaphore \subseteq  queue\\
  \forall  s: semaphore @ q\_max(s) = 1\\
  mutex \subseteq  queue\\
  \forall  m: mutex @ q\_max(m) = 1\\
  \dom  mutex\_holder = \{  m: mutex | q\_size(m) = 0 \}\\
  \ran  mutex\_holder \subseteq  tasks\\
  \forall  mh: \ran  mutex\_holder @ priority(mh) \geq  base\_priority(mh)\\
  \forall  ms: mutex \cup  semaphore @ ms \notin  \ran  wait\_snd \cup  \ran  release\_snd\\
  release\_mutex \subseteq  release\_rcv
\end{schema}

\begin{zproof}[TaskQueueTimeMutex\$domainCheck]
prove by reduce;
\end{zproof}

\begin{zed}
\Delta TaskQueueTimeMutex \defs TaskQueueTimeMutex \land  TaskQueueTimeMutex~' \land  \Delta Task
\end{zed}

\begin{schema}{Init\_TaskQueueTimeMutex}
  TaskQueueTimeMutex~'
\where
  Init\_TaskQueueTime\\
  Init\_Mutex
\end{schema}

\begin{theorem}{TaskQueueTimeMutexInit}
\exists  TaskQueueTimeMutex~' @ Init\_TaskQueueTimeMutex
\end{theorem}

\begin{zproof}[TaskQueueTimeMutexInit]
prove by reduce;
with enabled (disjointCat) prove;
apply extensionality to predicate \{\} = \{  f: \{\} | \{\} f = 0 \};
apply extensionality to predicate \{idle\} = \{idle\} \cup  (TASK \setminus  (\{  x\_\_0: TASK @ (x\_\_0, nonexistent) \} \inv  \limg  \{nonexistent\} \rimg ));
apply extensionality to predicate (\{  x\_\_3: TASK @ (x\_\_3, nonexistent) \} \oplus  \{(idle, running)\}) \inv  \limg  \{running\} \rimg  = \{idle\};
with enabled (applyOverride) prove;
\end{zproof}

\begin{schema}{ExtendTQTXi}
  \Delta TaskQueueTimeMutex
\where
  \Xi Mutex
\end{schema}

\begin{zed}
CreateTaskN\_TQTM \defs ExtendTQTXi \land  CreateTaskN\_TQT
\end{zed}

\begin{zed}
CreateTaskN\_TQTMFSBSig \defs TaskQueueTimeMutex \land  CreateTaskN\_TQTFSBSig
\end{zed}

\begin{theorem}{CreateTaskN\_TQTM\_vc\_ref}
\forall  CreateTaskN\_TQTMFSBSig | true @ \pre  CreateTaskN\_TQTM
\end{theorem}

\begin{zproof}[CreateTaskN\_TQTM\_vc\_ref]
use CreateTaskN\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
instantiate st\_\_0 == st;
instantiate mh\_\_0 == mh;
with enabled (applyOverride) prove;
apply inPower to predicate \ran  mutex\_holder \in  \power  tasks;
instantiate e == target?;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Task;
prove;
\end{zproof}

\begin{zed}
CreateTaskS\_TQTM \defs ExtendTQTXi \land  CreateTaskS\_TQT
\end{zed}

\begin{zed}
CreateTaskS\_TQTMFSBSig \defs TaskQueueTimeMutex \land  CreateTaskS\_TQTFSBSig
\end{zed}

\begin{theorem}{CreateTaskS\_TQTM\_vc\_ref}
\forall  CreateTaskS\_TQTMFSBSig | true @ \pre  CreateTaskS\_TQTM
\end{theorem}

\begin{zproof}[CreateTaskS\_TQTM\_vc\_ref]
use CreateTaskS\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
instantiate mh\_\_0 == mh;
instantiate st\_\_0 == st;
with enabled (applyOverride) prove;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Task;
apply inPower to predicate \ran  mutex\_holder \in  \power  tasks;
instantiate e == target?;
prove;
\end{zproof}

\begin{zed}
CreateTask\_TQTM \defs CreateTaskN\_TQTM \lor  CreateTaskS\_TQTM
\end{zed}

\begin{schema}{DeleteTaskN\_TQTM}
  \Delta TaskQueueTimeMutex\\
  DeleteTaskN\_TQT
\where
  target? \notin  \ran  mutex\_holder\\
  \Xi MutexData\\
  \Xi OriginalPrioData\\
  release\_mutex' = \{target?\} \ndres  release\_mutex
\end{schema}

\begin{schema}{DeleteTaskN\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  DeleteTaskN\_TQTFSBSig
\where
  target? \notin  \ran  mutex\_holder
\end{schema}

\begin{theorem}{DeleteTaskN\_TQTM\_vc\_ref}
\forall  DeleteTaskN\_TQTMFSBSig | true @ \pre  DeleteTaskN\_TQTM
\end{theorem}

\begin{zproof}[DeleteTaskN\_TQTM\_vc\_ref]
use DeleteTaskN\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
instantiate st\_\_0 == st;
prove;
cases;
apply inPower to predicate \ran  (\{target?\} \ndres  release\_mutex) \in  \power  (\dom  mutex\_recursive);
prove;
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
instantiate e\_\_0 == e;
with enabled (inRan) prove;
instantiate x\_\_3 == x;
prove;
next;
apply inPower to predicate \ran  mutex\_holder \in  \power  (TASK \setminus  (\{target?\} \cup  (state \inv  \limg  \{nonexistent\} \rimg )));
prove;
apply inPower to predicate \ran  mutex\_holder \in  \power  tasks;
instantiate e\_\_0 == e;
prove;
invoke TaskQueueTime;
invoke TaskQueue;
invoke Task;
prove;
next;
apply inPower to predicate \{target?\} \ndres  release\_mutex \in  \power  (\{target?\} \ndres  release\_rcv);
prove;
next;
instantiate ms\_\_0 == ms;
prove;
split ms \in  semaphore \lor  ms \in  \dom  mutex\_recursive;
with enabled (inRan) prove;
next;
\end{zproof}

\begin{schema}{DeleteTaskS\_TQTM}
  \Delta TaskQueueTimeMutex\\
  DeleteTaskS\_TQT
\where
  target? \notin  \ran  mutex\_holder\\
  \Xi Mutex
\end{schema}

\begin{schema}{DeleteTaskS\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  DeleteTaskS\_TQTFSBSig
\where
  target? \notin  \ran  mutex\_holder
\end{schema}

\begin{theorem}{lDeleteTaskS\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topReady!, target?: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  target? \in  tasks \setminus  \{idle\} \land  state(target?) \in  \{running\} \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  target? \notin  \ran  mutex\_holder @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(target?, bare\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\}), tasks := tasks \setminus  \{target?\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(target?, nonexistent)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lDeleteTaskS\_TQTM\_Lemma]
use lDeleteTaskS\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
instantiate rtsk\_\_0 == t;
apply inPower to predicate \ran  mutex\_holder \in  \power  (tasks \setminus  \{target?\});
prove;
\end{zproof}

\begin{theorem}{DeleteTaskS\_TQTM\_vc\_ref}
\forall  DeleteTaskS\_TQTMFSBSig | true @ \pre  DeleteTaskS\_TQTM
\end{theorem}

\begin{zproof}[DeleteTaskS\_TQTM\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lDeleteTaskS\_TQTM\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
\end{zproof}

\begin{zed}
DeleteTask\_TQTM \defs DeleteTaskN\_TQTM \lor  DeleteTaskS\_TQTM
\end{zed}

\begin{zed}
ExecuteRunningTask\_TQTM \defs ExtendTQTXi \land  ExecuteRunningTask\_TQT
\end{zed}

\begin{zed}
ExecuteRunningTask\_TQTMFSBSig \defs TaskQueueTimeMutex \land  ExecuteRunningTask\_TQTFSBSig
\end{zed}

\begin{theorem}{ExecuteRunningTask\_TQTM\_vc\_ref}
\forall  ExecuteRunningTask\_TQTMFSBSig | true @ \pre  ExecuteRunningTask\_TQTM
\end{theorem}

\begin{zproof}[ExecuteRunningTask\_TQTM\_vc\_ref]
with disabled (TaskData, StateData, PrioData, Queue, Time, Mutex) prove by reduce;
\end{zproof}

\begin{zed}
SuspendTaskN\_TQTM \defs ExtendTQTXi \land  SuspendTaskN\_TQT
\end{zed}

\begin{zed}
SuspendTaskN\_TQTMFSBSig \defs TaskQueueTimeMutex \land  SuspendTaskN\_TQTFSBSig
\end{zed}

\begin{theorem}{SuspendTaskN\_TQTM\_vc\_ref}
\forall  SuspendTaskN\_TQTMFSBSig | true @ \pre  SuspendTaskN\_TQTM
\end{theorem}

\begin{zproof}[SuspendTaskN\_TQTM\_vc\_ref]
use SuspendTaskN\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
instantiate st\_\_0 == st;
instantiate ms\_\_0 == ms;
split ms \in  semaphore \lor  ms \in  \dom  mutex\_recursive;
with enabled (inRan) prove;
\end{zproof}

\begin{zed}
SuspendTaskS\_TQTM \defs ExtendTQTXi \land  SuspendTaskS\_TQT
\end{zed}

\begin{zed}
SuspendTaskS\_TQTMFSBSig \defs TaskQueueTimeMutex \land  SuspendTaskS\_TQTFSBSig
\end{zed}

\begin{theorem}{lSuspendTaskS\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; target?, topReady!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  target? \in  tasks \setminus  \{idle\} \land  state(target?) \in  \{running\} \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, suspended)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lSuspendTaskS\_TQTM\_Lemma]
use lSuspendTaskS\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
instantiate rtsk\_\_0 == t;
prove;
\end{zproof}

\begin{theorem}{SuspendTaskS\_TQTM\_vc\_ref}
\forall  SuspendTaskS\_TQTMFSBSig | true @ \pre  SuspendTaskS\_TQTM
\end{theorem}

\begin{zproof}[SuspendTaskS\_TQTM\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lSuspendTaskS\_TQTM\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
\end{zproof}

\begin{zed}
SuspendTaskO\_TQTM \defs ExtendTQTXi \land  SuspendTaskO\_TQT
\end{zed}

\begin{zed}
SuspendTaskO\_TQTMFSBSig \defs TaskQueueTimeMutex \land  SuspendTaskO\_TQTFSBSig
\end{zed}

\begin{theorem}{SuspendTaskO\_TQTM\_vc\_ref}
\forall  SuspendTaskO\_TQTMFSBSig | true @ \pre  SuspendTaskO\_TQTM
\end{theorem}

\begin{zproof}[SuspendTaskO\_TQTM\_vc\_ref]
with disabled (TaskQueueTimeMutex) prove by reduce;
\end{zproof}

\begin{zed}
SuspendTask\_TQTM \defs SuspendTaskN\_TQTM \lor  SuspendTaskS\_TQTM \lor  SuspendTaskO\_TQTM
\end{zed}

\begin{zed}
ResumeTaskN\_TQTM \defs ExtendTQTXi \land  ResumeTaskN\_TQT
\end{zed}

\begin{zed}
ResumeTaskN\_TQTMFSBSig \defs TaskQueueTimeMutex \land  ResumeTaskN\_TQTFSBSig
\end{zed}

\begin{theorem}{ResumeTaskN\_TQTM\_vc\_ref}
\forall  ResumeTaskN\_TQTMFSBSig | true @ \pre  ResumeTaskN\_TQTM
\end{theorem}

\begin{zproof}[ResumeTaskN\_TQTM\_vc\_ref]
use ResumeTaskN\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
instantiate st\_\_0 == st;
prove;
\end{zproof}

\begin{zed}
ResumeTaskS\_TQTM \defs ExtendTQTXi \land  ResumeTaskS\_TQT
\end{zed}

\begin{zed}
ResumeTaskS\_TQTMFSBSig \defs TaskQueueTimeMutex \land  ResumeTaskS\_TQTFSBSig
\end{zed}

\begin{theorem}{ResumeTaskS\_TQTM\_vc\_ref}
\forall  ResumeTaskS\_TQTMFSBSig | true @ \pre  ResumeTaskS\_TQTM
\end{theorem}

\begin{zproof}[ResumeTaskS\_TQTM\_vc\_ref]
use ResumeTaskS\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
instantiate st\_\_0 == st;
prove;
\end{zproof}

\begin{zed}
ResumeTask\_TQTM \defs ResumeTaskN\_TQTM \lor  ResumeTaskS\_TQTM
\end{zed}

\begin{schema}{ChangeTaskPriorityNNotHolder\_TQTM}
  \Delta TaskQueueTimeMutex\\
  ChangeTaskPriorityN\_TQT
\where
  target? \notin  \dom  base\_priority\\
  \Xi Mutex
\end{schema}

\begin{schema}{ChangeTaskPriorityNNotHolder\_TQTMFSBSig}
  ChangeTaskPriorityN\_TQTFSBSig\\
  TaskQueueTimeMutex
\where
  target? \notin  \dom  base\_priority
\end{schema}

\begin{theorem}{ChangeTaskPriorityNNotHolder\_TQTM\_vc\_ref}
\forall  ChangeTaskPriorityNNotHolder\_TQTMFSBSig | true @ \pre  ChangeTaskPriorityNNotHolder\_TQTM
\end{theorem}

\begin{zproof}[ChangeTaskPriorityNNotHolder\_TQTM\_vc\_ref]
with enabled (applyOverride) prove by reduce;
cases;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
instantiate t\_\_0 == pt;
with normalization rewrite;
next;
prove;
next;
\end{zproof}

\begin{schema}{ChangeTaskPrioritySNotHolder\_TQTM}
  ChangeTaskPriorityS\_TQT\\
  \Delta TaskQueueTimeMutex
\where
  target? \notin  \dom  base\_priority\\
  \Xi Mutex
\end{schema}

\begin{schema}{ChangeTaskPrioritySNotHolder\_TQTMFSBSig}
  ChangeTaskPriorityS\_TQTFSBSig\\
  TaskQueueTimeMutex
\where
  target? \notin  \dom  base\_priority
\end{schema}

\begin{theorem}{ChangeTaskPrioritySNotHolder\_TQTM\_vc\_ref}
\forall  ChangeTaskPrioritySNotHolder\_TQTMFSBSig | true @ \pre  ChangeTaskPrioritySNotHolder\_TQTM
\end{theorem}

\begin{zproof}[ChangeTaskPrioritySNotHolder\_TQTM\_vc\_ref]
use ChangeTaskPriorityS\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
instantiate st\_\_0 == st;
prove;
\end{zproof}

\begin{schema}{ChangeTaskPriorityDNotHolder\_TQTM}
  \Delta TaskQueueTimeMutex\\
  ChangeTaskPriorityD\_TQT
\where
  target? \notin  \dom  base\_priority\\
  \Xi Mutex
\end{schema}

\begin{schema}{ChangeTaskPriorityDNotHolder\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  ChangeTaskPriorityD\_TQTFSBSig
\where
  target? \notin  \dom  base\_priority
\end{schema}

\begin{theorem}{lChangeTaskPriorityDNotHolder\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; target?, topReady!: TASK; newpri?: \nat  | state(target?) = running \land  (target? = idle \implies  newpri? = 0) \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  newpri? < priority(topReady!) \land  target? \notin  \dom  base\_priority @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), priority := priority \oplus  \{(target?, newpri?)\}, running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})] \land  newpri? < priority(topReady!) \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lChangeTaskPriorityDNotHolder\_TQTM\_Lemma]
use lChangeTaskPriorityD\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
instantiate rtsk\_\_0 == t;
prove;
\end{zproof}

\begin{theorem}{ChangeTaskPriorityDNotHolder\_TQTM\_vc\_ref}
\forall  ChangeTaskPriorityDNotHolder\_TQTMFSBSig | true @ \pre  ChangeTaskPriorityDNotHolder\_TQTM
\end{theorem}

\begin{zproof}[ChangeTaskPriorityDNotHolder\_TQTM\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lChangeTaskPriorityDNotHolder\_TQTM\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == readyTask;
instantiate t\_\_0 == rtsk;
instantiate t\_\_0 == t;
prove;
\end{zproof}

\begin{schema}{ChangeTaskPriorityNNotInherited\_TQTM}
  ChangeTaskPriorityN\_TQT\\
  \Delta TaskQueueTimeMutex
\where
  target? \in  \dom  base\_priority\\
  base\_priority(target?) = priority(target?)\\
  \Xi MutexData\\
  base\_priority' = base\_priority \oplus  \{(target? \mapsto  newpri?)\}\\
  \Xi MReleasingData
\end{schema}

\begin{zproof}[ChangeTaskPriorityNNotInherited\_TQTM\$domainCheck]
prove;
\end{zproof}

\begin{schema}{ChangeTaskPriorityNNotInherited\_TQTMFSBSig}
  ChangeTaskPriorityN\_TQTFSBSig\\
  TaskQueueTimeMutex
\where
  target? \in  \dom  base\_priority\\
  base\_priority(target?) = priority(target?)
\end{schema}

\begin{zproof}[ChangeTaskPriorityNNotInherited\_TQTMFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{ChangeTaskPriorityNNotInherited\_TQTM\_vc\_ref}
\forall  ChangeTaskPriorityNNotInherited\_TQTMFSBSig | true @ \pre  ChangeTaskPriorityNNotInherited\_TQTM
\end{theorem}

\begin{zproof}[ChangeTaskPriorityNNotInherited\_TQTM\_vc\_ref]
with enabled (applyOverride) prove by reduce;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
instantiate t\_\_0 == pt;
cases;
apply extensionality to predicate \{target?\} \cup  \dom  base\_priority = \ran  mutex\_holder;
prove;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate x\_\_1 == x;
prove;
with normalization simplify;
next;
with normalization rewrite;
next;
prove;
next;
\end{zproof}

\begin{schema}{ChangeTaskPrioritySNotInherited\_TQTM}
  ChangeTaskPriorityS\_TQT\\
  \Delta TaskQueueTimeMutex
\where
  target? \in  \dom  base\_priority\\
  base\_priority(target?) = priority(target?)\\
  \Xi MutexData\\
  base\_priority' = base\_priority \oplus  \{(target? \mapsto  newpri?)\}\\
  \Xi MReleasingData
\end{schema}

\begin{zproof}[ChangeTaskPrioritySNotInherited\_TQTM\$domainCheck]
prove;
\end{zproof}

\begin{schema}{ChangeTaskPrioritySNotInherited\_TQTMFSBSig}
  ChangeTaskPriorityS\_TQTFSBSig\\
  TaskQueueTimeMutex
\where
  target? \in  \dom  base\_priority\\
  base\_priority(target?) = priority(target?)
\end{schema}

\begin{zproof}[ChangeTaskPrioritySNotInherited\_TQTMFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{ChangeTaskPrioritySNotInherited\_TQTM\_vc\_ref}
\forall  ChangeTaskPrioritySNotInherited\_TQTMFSBSig | true @ \pre  ChangeTaskPrioritySNotInherited\_TQTM
\end{theorem}

\begin{zproof}[ChangeTaskPrioritySNotInherited\_TQTM\_vc\_ref]
use ChangeTaskPriorityS\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
apply extensionality to predicate \{target?\} \cup  \dom  base\_priority = \ran  mutex\_holder;
instantiate st\_\_0 == st;
instantiate mh\_\_0 == mh;
with enabled (applyOverride) prove;
cases;
with normalization simplify;
next;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate x == mh;
prove;
next;
\end{zproof}

\begin{schema}{ChangeTaskPriorityDNotInherited\_TQTM}
  \Delta TaskQueueTimeMutex\\
  ChangeTaskPriorityD\_TQT
\where
  target? \in  \dom  base\_priority\\
  base\_priority(target?) = priority(target?)\\
  \Xi MutexData\\
  base\_priority' = base\_priority \oplus  \{(target? \mapsto  newpri?)\}\\
  \Xi MReleasingData
\end{schema}

\begin{zproof}[ChangeTaskPriorityDNotInherited\_TQTM\$domainCheck]
prove;
\end{zproof}

\begin{schema}{ChangeTaskPriorityDNotInherited\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  ChangeTaskPriorityD\_TQTFSBSig
\where
  target? \in  \dom  base\_priority\\
  base\_priority(target?) = priority(target?)
\end{schema}

\begin{zproof}[ChangeTaskPriorityDNotInherited\_TQTMFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{lChangeTaskPriorityDNotInherited\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; target?, topReady!: TASK; newpri?: \nat  | state(target?) = running \land  (target? = idle \implies  newpri? = 0) \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  newpri? < priority(topReady!) \land  target? \in  \dom  base\_priority \land  base\_priority(target?) = priority(target?) @ \lnot  (TaskQueueTimeMutex[base\_priority := base\_priority \oplus  \{(target?, newpri?)\}, log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), priority := priority \oplus  \{(target?, newpri?)\}, running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})] \land  newpri? < priority(topReady!) \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lChangeTaskPriorityDNotInherited\_TQTM\_Lemma]
use lChangeTaskPriorityD\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
instantiate rtsk\_\_0 == t;
instantiate mh\_\_0 == mh;
apply extensionality to predicate \{target?\} \cup  \dom  base\_priority = \ran  mutex\_holder;
prove;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate x\_\_0 == x;
instantiate x\_\_0 == mh;
with enabled (applyOverride) prove;
cases;
with normalization simplify;
next;
prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{ChangeTaskPriorityDNotInherited\_TQTM\_vc\_ref}
\forall  ChangeTaskPriorityDNotInherited\_TQTMFSBSig | true @ \pre  ChangeTaskPriorityDNotInherited\_TQTM
\end{theorem}

\begin{zproof}[ChangeTaskPriorityDNotInherited\_TQTM\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lChangeTaskPriorityDNotInherited\_TQTM\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == readyTask;
instantiate t\_\_0 == rtsk;
instantiate t\_\_0 == t;
prove;
\end{zproof}

\begin{schema}{ChangeTaskPriorityInheritedN\_TQTM}
  \Delta TaskQueueTimeMutex\\
  newpri?: \nat \\
  target?: TASK\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  target? \in  \dom  base\_priority\\
  base\_priority(target?) \neq  priority(target?)\\
  newpri? \leq  priority(target?)\\
  state(target?) \neq  nonexistent\\
  target? = idle \implies  newpri? = 0\\
  \Xi TaskQueueTime\\
  \Xi MutexData\\
  base\_priority' = base\_priority \oplus  \{(target? \mapsto  newpri?)\}\\
  \Xi MReleasingData\\
  topReady! = running\_task
\end{schema}

\begin{zproof}[ChangeTaskPriorityInheritedN\_TQTM\$domainCheck]
prove;
\end{zproof}

\begin{schema}{ChangeTaskPriorityInheritedN\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  newpri?: \nat \\
  target?: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  target? \in  \dom  base\_priority\\
  base\_priority(target?) \neq  priority(target?)\\
  newpri? \leq  priority(target?)\\
  state(target?) \neq  nonexistent\\
  target? = idle \implies  newpri? = 0
\end{schema}

\begin{zproof}[ChangeTaskPriorityInheritedN\_TQTMFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{ChangeTaskPriorityInheritedN\_TQTM\_vc\_ref}
\forall  ChangeTaskPriorityInheritedN\_TQTMFSBSig | true @ \pre  ChangeTaskPriorityInheritedN\_TQTM
\end{theorem}

\begin{zproof}[ChangeTaskPriorityInheritedN\_TQTM\_vc\_ref]
with enabled (applyOverride) prove by reduce;
apply extensionality to predicate \{target?\} \cup  \dom  base\_priority = \ran  mutex\_holder;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
prove;
instantiate x\_\_0 == x;
instantiate y\_\_0 == y;
with normalization simplify;
\end{zproof}

\begin{schema}{ChangeTaskPriorityInheritedU\_TQTM}
  \Delta TaskQueueTimeMutex\\
  ChangeTaskPriorityN\_TQT
\where
  target? \in  \dom  base\_priority\\
  base\_priority(target?) \neq  priority(target?)\\
  newpri? > priority(target?)\\
  \Xi MutexData\\
  base\_priority' = base\_priority \oplus  \{(target? \mapsto  newpri?)\}\\
  \Xi MReleasingData
\end{schema}

\begin{zproof}[ChangeTaskPriorityInheritedU\_TQTM\$domainCheck]
prove;
\end{zproof}

\begin{schema}{ChangeTaskPriorityInheritedU\_TQTMFSBSig}
  ChangeTaskPriorityN\_TQTFSBSig\\
  TaskQueueTimeMutex
\where
  target? \in  \dom  base\_priority\\
  base\_priority(target?) \neq  priority(target?)\\
  newpri? > priority(target?)
\end{schema}

\begin{zproof}[ChangeTaskPriorityInheritedU\_TQTMFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{ChangeTaskPriorityInheritedU\_TQTM\_vc\_ref}
\forall  ChangeTaskPriorityInheritedU\_TQTMFSBSig | true @ \pre  ChangeTaskPriorityInheritedU\_TQTM
\end{theorem}

\begin{zproof}[ChangeTaskPriorityInheritedU\_TQTM\_vc\_ref]
with enabled (applyOverride) prove by reduce;
apply extensionality to predicate \{target?\} \cup  \dom  base\_priority = \ran  mutex\_holder;
instantiate t\_\_0 == pt;
prove;
cases;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate x\_\_0 == x;
with normalization simplify;
next;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
with normalization rewrite;
next;
prove;
next;
\end{zproof}

\begin{schema}{ChangeTaskPriorityInheritedS\_TQTM}
  \Delta TaskQueueTimeMutex\\
  ChangeTaskPriorityS\_TQT
\where
  target? \in  \dom  base\_priority\\
  base\_priority(target?) \neq  priority(target?)\\
  newpri? > priority(target?)\\
  \Xi MutexData\\
  base\_priority' = base\_priority \oplus  \{(target? \mapsto  newpri?)\}\\
  \Xi MReleasingData
\end{schema}

\begin{zproof}[ChangeTaskPriorityInheritedS\_TQTM\$domainCheck]
prove;
\end{zproof}

\begin{schema}{ChangeTaskPriorityInheritedS\_TQTMFSBSig}
  ChangeTaskPriorityS\_TQTFSBSig\\
  TaskQueueTimeMutex
\where
  target? \in  \dom  base\_priority\\
  base\_priority(target?) \neq  priority(target?)\\
  newpri? > priority(target?)
\end{schema}

\begin{zproof}[ChangeTaskPriorityInheritedS\_TQTMFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{ChangeTaskPriorityInheritedS\_TQTM\_vc\_ref}
\forall  ChangeTaskPriorityInheritedS\_TQTMFSBSig | true @ \pre  ChangeTaskPriorityInheritedS\_TQTM
\end{theorem}

\begin{zproof}[ChangeTaskPriorityInheritedS\_TQTM\_vc\_ref]
use ChangeTaskPriorityS\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
apply extensionality to predicate \{target?\} \cup  \dom  base\_priority = \ran  mutex\_holder;
instantiate mh\_\_0 == mh;
instantiate st\_\_0 == st;
prove;
cases;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate x\_\_0 == x;
with normalization simplify;
next;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate x == mh;
with enabled (applyOverride) prove;
next;
\end{zproof}

\begin{zed}
ChangeTaskPriority\_TQTM \defs ChangeTaskPriorityNNotHolder\_TQTM \lor  ChangeTaskPrioritySNotHolder\_TQTM \lor  ChangeTaskPriorityDNotHolder\_TQTM \lor  ChangeTaskPriorityNNotInherited\_TQTM \lor  ChangeTaskPrioritySNotInherited\_TQTM \lor  ChangeTaskPriorityDNotInherited\_TQTM \lor  ChangeTaskPriorityInheritedN\_TQTM \lor  ChangeTaskPriorityInheritedU\_TQTM \lor  ChangeTaskPriorityInheritedS\_TQTM
\end{zed}

\begin{zed}
CreateQueue\_TQTM \defs ExtendTQTXi \land  CreateQueue\_TQT
\end{zed}

\begin{zed}
CreateQueue\_TQTMFSBSig \defs TaskQueueTimeMutex \land  CreateQueue\_TQTFSBSig
\end{zed}

\begin{theorem}{CreateQueue\_TQTM\_vc\_ref}
\forall  CreateQueue\_TQTMFSBSig | true @ \pre  CreateQueue\_TQTM
\end{theorem}

\begin{zproof}[CreateQueue\_TQTM\_vc\_ref]
use CreateQueue\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(que?, 0)\}) f\_\_1 = 0 \};
instantiate s\_\_0 == s;
instantiate m\_\_1 == m;
apply inPower to predicate \dom  mutex\_recursive \in  \power  queue;
apply inPower to predicate semaphore \in  \power  queue;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Queue;
invoke QueueData;
prove;
instantiate e\_\_0 == x;
instantiate e\_\_0 == y;
instantiate e\_\_0 == m;
instantiate e == s;
apply applyOverride to expression (q\_max \oplus  \{(que?, size?)\}) s;
apply applyOverride to expression (q\_max \oplus  \{(que?, size?)\}) m;
prove;
\end{zproof}

\begin{schema}{DeleteQueue\_TQTM}
  DeleteQueue\_TQT\\
  \Delta TaskQueueTimeMutex
\where
  que? \notin  semaphore \cup  mutex\\
  \Xi Mutex
\end{schema}

\begin{schema}{DeleteQueue\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  DeleteQueue\_TQTFSBSig
\where
  que? \notin  semaphore \cup  mutex
\end{schema}

\begin{theorem}{DeleteQueue\_TQTM\_vc\_ref}
\forall  DeleteQueue\_TQTMFSBSig | true @ \pre  DeleteQueue\_TQTM
\end{theorem}

\begin{zproof}[DeleteQueue\_TQTM\_vc\_ref]
use DeleteQueue\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
apply inPower to predicate semaphore \in  \power  (queue \setminus  \{que?\});
apply inPower to predicate \dom  mutex\_recursive \in  \power  (queue \setminus  \{que?\});
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} = \{  f\_\_1: \dom  mutex\_recursive | (\{que?\} \ndres  q\_size) f\_\_1 = 0 \};
instantiate s\_\_0 == s;
instantiate m\_\_1 == m;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Queue;
invoke QueueData;
prove;
\end{zproof}

\begin{schema}{QueueSendN\_TQTM}
  QueueSendN\_TQT\\
  \Delta TaskQueueTimeMutex
\where
  que? \notin  mutex \cup  semaphore\\
  \Xi Mutex
\end{schema}

\begin{schema}{QueueSendN\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  QueueSendN\_TQTFSBSig
\where
  que? \notin  mutex \cup  semaphore
\end{schema}

\begin{theorem}{QueueSendN\_TQTM\_vc\_ref}
\forall  QueueSendN\_TQTMFSBSig | true @ \pre  QueueSendN\_TQTM
\end{theorem}

\begin{zproof}[QueueSendN\_TQTM\_vc\_ref]
use QueueSendN\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(que?, (1 + q\_size(que?)))\}) f\_\_1 = 0 \};
instantiate ms\_\_0 == ms;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Queue;
invoke QueueData;
with enabled (inRan) prove;
instantiate x\_\_3 == x;
prove;
\end{zproof}

\begin{schema}{QueueSendF\_TQTM}
  \Delta TaskQueueTimeMutex\\
  QueueSendF\_TQT
\where
  que? \notin  mutex \cup  semaphore\\
  \Xi Mutex
\end{schema}

\begin{schema}{QueueSendF\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  QueueSendF\_TQTFSBSig
\where
  que? \notin  mutex \cup  semaphore
\end{schema}

\begin{theorem}{lQueueSendF\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topReady!: TASK; que?: QUEUE; n?: \nat  | running\_task \notin  \dom  release\_rcv \land  (running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)) \land  que? \in  queue \land  q\_size(que?) = q\_max(que?) \land  running\_task \neq  idle \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  n? > clock \land  que? \notin  mutex \cup  semaphore @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), release\_snd := \{running\_task\} \ndres  release\_snd, running\_task := topReady!, state := state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\}), time := time \oplus  \{(running\_task, n?)\}, wait\_snd := wait\_snd \oplus  \{(running\_task, que?)\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lQueueSendF\_TQTM\_Lemma]
use lQueueSendF\_TQT\_Lemma;
with disabled (TaskQueueTime, partitionDef) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
instantiate rtsk\_\_0 == t;
instantiate ms\_\_0 == ms;
with enabled (inRan) prove;
instantiate x\_\_3 == x;
instantiate x\_\_4 == x\_\_0;
apply oplusDef to expression wait\_snd \oplus  \{(running\_task, que?)\};
prove;
\end{zproof}

\begin{theorem}{QueueSendF\_TQTM\_vc\_ref}
\forall  QueueSendF\_TQTMFSBSig | true @ \pre  QueueSendF\_TQTM
\end{theorem}

\begin{zproof}[QueueSendF\_TQTM\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lQueueSendF\_TQTM\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
with normalization rewrite;
\end{zproof}

\begin{schema}{QueueSendW\_TQTM}
  \Delta TaskQueueTimeMutex\\
  QueueSendW\_TQT
\where
  que? \notin  mutex \cup  semaphore\\
  \Xi Mutex
\end{schema}

\begin{schema}{QueueSendW\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  QueueSendW\_TQTFSBSig
\where
  que? \notin  mutex \cup  semaphore
\end{schema}

\begin{theorem}{overrideIsAppend}[X, Y]
\forall  f, g: X \pfun  Y | \dom  f \cap  \dom  g = \emptyset @ f \subseteq  f \oplus  g
\end{theorem}

\begin{zproof}[overrideIsAppend]
prove; 
apply inPower to predicate f \in \power ((\_ \oplus \_) [X, Y] (f, g)); 
apply oplusDef to expression (\_ \oplus \_) [X, Y] (f, g); 
apply extensionality to predicate (\_ \cap \_) [X] ((\dom [X, Y] f), (\dom [X, Y] g)) = \{\};
prove; 
instantiate x == e.1;
prove; 
apply inDom to predicate e . 1 \in \dom [X, Y] f;
instantiate y == e.2;
invoke (\_\pfun \_);
invoke (\_\rel \_);
prove; 
apply inPower to predicate f \in \power (X \cross Y);
instantiate e\_\_0 == e;
prove;
\end{zproof}

\begin{theorem}{lQueueSendW\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topReady!: TASK; que?: QUEUE | running\_task \notin  \dom  release\_rcv \land  (running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)) \land  que? \in  queue \land  q\_size(que?) < q\_max(que?) \land  topReady! \in  wait\_rcv \inv  \limg  \{que?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(running\_task) \geq  priority(topReady!) \land  que? \notin  mutex \cup  semaphore @ \lnot  (TaskQueueTimeMutex[q\_size := q\_size \oplus  \{(que?, (1 + q\_size(que?)))\}, release\_rcv := release\_rcv \oplus  \{(topReady!, que?)\}, release\_snd := \{running\_task\} \ndres  release\_snd, state := state \oplus  \{(topReady!, ready)\}, time := \{topReady!\} \ndres  time, wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  priority(topReady!) \leq  priority(running\_task) \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topReady!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topReady!, ready)\}) st) \in  transition) \implies  wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = que? \land  \lnot  priority(topReady!) \geq  priority(wr))
\end{theorem}

\begin{zproof}[lQueueSendW\_TQTM\_Lemma]
use lQueueSendW\_TQT\_Lemma;
with disabled (TaskQueueTime, partitionDef) prove by reduce;
instantiate wrct\_\_0 == wrct;
instantiate wrct\_\_0 == wr;
instantiate ms\_\_0 == ms;
with enabled (inRan) prove;
instantiate x\_\_2 == x;
prove;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Queue;
cases;
apply extensionality to predicate (\dom  wait\_snd \cup  \dom  wait\_rcv) \cap  (\dom  release\_snd \cup  \dom  release\_rcv) = \emptyset;
instantiate x\_\_0 == topReady!;
prove;
apply inPower to predicate release\_mutex \in  \power  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
use overrideIsAppend[TASK, QUEUE][f := release\_rcv, g := \{(topReady!, wait\_rcv(topReady!))\}];
prove;
apply inPower to predicate release\_rcv \in  \power  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\});
instantiate e\_\_1 == e;
prove;
next;
invoke QueueData;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topReady!), (1 + q\_size (wait\_rcv(topReady!))))\}) f\_\_1 = 0 \};
prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{QueueSendW\_TQTM\_vc\_ref}
\forall  QueueSendW\_TQTMFSBSig | true @ \pre  QueueSendW\_TQTM
\end{theorem}

\begin{zproof}[QueueSendW\_TQTM\_vc\_ref]
use findDelegate[a := wait\_rcv \inv  \limg  \{que?\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate topReady! == f (wait\_rcv \inv  \limg  \{que?\} \rimg );
prove;
use lQueueSendW\_TQTM\_Lemma[topReady! := f (wait\_rcv \inv  \limg  \{que?\} \rimg )];
prove;
instantiate wr\_\_0 == f (wait\_rcv \inv  \limg  \{que?\} \rimg );
instantiate t == wrct;
with normalization rewrite;
\end{zproof}

\begin{schema}{QueueSendWS\_TQTM}
  \Delta TaskQueueTimeMutex\\
  QueueSendWS\_TQT
\where
  que? \notin  mutex \cup  semaphore\\
  \Xi Mutex
\end{schema}

\begin{schema}{QueueSendWS\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  QueueSendWS\_TQTFSBSig
\where
  que? \notin  mutex \cup  semaphore
\end{schema}

\begin{theorem}{lQueueSendWS\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topReady!: TASK; que?: QUEUE | running\_task \notin  \dom  release\_rcv \land  (running\_task \in  \dom  release\_snd \implies  que? = release\_snd(running\_task)) \land  que? \in  queue \land  q\_size(que?) < q\_max(que?) \land  topReady! \in  wait\_rcv \inv  \limg  \{que?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(topReady!) > priority(running\_task) \land  que? \notin  mutex \cup  semaphore @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), q\_size := q\_size \oplus  \{(wait\_rcv(topReady!), (1 + q\_size (wait\_rcv(topReady!))))\}, release\_rcv := release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\}, release\_snd := \{running\_task\} \ndres  release\_snd, running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\}), time := \{topReady!\} \ndres  time, wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = wait\_rcv(topReady!) \land  \lnot  priority(topReady!) \geq  priority(wr))
\end{theorem}

\begin{zproof}[lQueueSendWS\_TQTM\_Lemma]
use lQueueSendWS\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate wrct\_\_0 == wrct;
instantiate wrct\_\_0 == wr;
instantiate ms\_\_0 == ms;
with enabled (inRan) prove;
instantiate x\_\_2 == x;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Queue;
prove;
cases;
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == topReady!;
apply inPower to predicate release\_mutex \in  \power  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
use overrideIsAppend[TASK, QUEUE][f := release\_rcv, g := \{(topReady!, wait\_rcv(topReady!))\}];
prove;
apply inPower to predicate release\_rcv \in  \power  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\});
instantiate e\_\_1 == e;
prove;
next;
invoke QueueData;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topReady!), (1 + q\_size (wait\_rcv(topReady!))))\}) f\_\_1 = 0 \};
prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{QueueSendWS\_TQTM\_vc\_ref}
\forall  QueueSendWS\_TQTMFSBSig | true @ \pre  QueueSendWS\_TQTM
\end{theorem}

\begin{zproof}[QueueSendWS\_TQTM\_vc\_ref]
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == topReady!;
prove;
use lQueueSendWS\_TQTM\_Lemma;
prove;
instantiate wr\_\_0 == wrct;
prove;
with normalization rewrite;
\end{zproof}

\begin{zed}
QueueSend\_TQTM \defs QueueSendN\_TQTM \lor  QueueSendF\_TQTM \lor  QueueSendW\_TQTM \lor  QueueSendWS\_TQTM
\end{zed}

\begin{schema}{QueueReceiveN\_TQTM}
  QueueReceiveN\_TQT\\
  \Delta TaskQueueTimeMutex
\where
  running\_task \notin  \dom  release\_mutex\\
  que? \notin  mutex \cup  semaphore\\
  \Xi Mutex
\end{schema}

\begin{schema}{QueueReceiveN\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  QueueReceiveN\_TQTFSBSig
\where
  running\_task \notin  \dom  release\_mutex\\
  que? \notin  mutex \cup  semaphore
\end{schema}

\begin{theorem}{mutexDiffQue}
\forall  TaskQueueTimeMutex | que? \notin  mutex \cup  semaphore @ \dom  mutex\_holder = \{  f\_\_1: mutex | (q\_size \oplus  \{(que?, (q\_size(que?) - 1))\}) f\_\_1 = 0 \}
\end{theorem}

\begin{zproof}[mutexDiffQue]
apply extensionality to predicate \dom  mutex\_holder = \{  f: mutex | (q\_size \oplus  \{(que?, (q\_size(que?) - 1))\}) f = 0 \};
with disabled (Task, Time) prove by reduce;
\end{zproof}

\begin{theorem}{QueueReceiveN\_TQTM\_vc\_ref}
\forall  QueueReceiveN\_TQTMFSBSig | true @ \pre  QueueReceiveN\_TQTM
\end{theorem}

\begin{zproof}[QueueReceiveN\_TQTM\_vc\_ref]
use mutexDiffQue;
use QueueReceiveN\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
apply inPower to predicate release\_mutex \in  \power  (\{running\_task\} \ndres  release\_rcv);
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
apply inDom to predicate running\_task \in  \dom  release\_mutex;
prove;
instantiate y == e.2;
invoke (\_\pfun \_);
invoke (\_\rel \_);
prove;
apply inPower to predicate release\_mutex \in  \power  (TASK \cross  QUEUE);
instantiate e\_\_0 == e;
prove;
\end{zproof}

\begin{schema}{QueueReceiveE\_TQTM}
  \Delta TaskQueueTimeMutex\\
  QueueReceiveE\_TQT
\where
  running\_task \notin  \dom  release\_mutex\\
  que? \notin  mutex \cup  semaphore\\
  \Xi Mutex
\end{schema}

\begin{schema}{QueueReceiveE\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  QueueReceiveE\_TQTFSBSig
\where
  running\_task \notin  \dom  release\_mutex\\
  que? \notin  mutex \cup  semaphore
\end{schema}

\begin{theorem}{lQueueReceiveE\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; que?: QUEUE; topReady!: TASK; n?: \nat  | running\_task \notin  \dom  release\_snd \land  (running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)) \land  que? \in  queue \land  q\_size(que?) = 0 \land  running\_task \neq  idle \land  topReady! \in  state \inv  \limg  \{ready\} \rimg  \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  n? > clock \land  running\_task \notin  \dom  release\_mutex \land  que? \notin  mutex \cup  semaphore @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), release\_rcv := \{running\_task\} \ndres  release\_rcv, running\_task := topReady!, state := state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\}), time := time \oplus  \{(running\_task, n?)\}, wait\_rcv := wait\_rcv \oplus  \{(running\_task, que?)\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lQueueReceiveE\_TQTM\_Lemma]
use lQueueReceiveE\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
instantiate rtsk\_\_0 == t;
apply inPower to predicate release\_mutex \in  \power  (\{running\_task\} \ndres  release\_rcv);
prove;
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
instantiate e\_\_0 == e;
apply inDom to predicate running\_task \in  \dom  release\_mutex;
instantiate y == e.2;
cases;
invoke (\_\pfun \_);
invoke (\_\rel \_);
prove;
apply inPower to predicate release\_mutex \in  \power  (TASK \cross  QUEUE);
instantiate e\_\_0 == e;
prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{QueueReceiveE\_TQTM\_vc\_ref}
\forall  QueueReceiveE\_TQTMFSBSig | true @ \pre  QueueReceiveE\_TQTM
\end{theorem}

\begin{zproof}[QueueReceiveE\_TQTM\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lQueueReceiveE\_TQTM\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
with normalization rewrite;
\end{zproof}

\begin{schema}{QueueReceiveW\_TQTM}
  \Delta TaskQueueTimeMutex\\
  QueueReceiveW\_TQT
\where
  running\_task \notin  \dom  release\_mutex\\
  que? \notin  mutex \cup  semaphore\\
  \Xi Mutex
\end{schema}

\begin{schema}{QueueReceiveW\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  QueueReceiveW\_TQTFSBSig
\where
  running\_task \notin  \dom  release\_mutex\\
  que? \notin  mutex \cup  semaphore
\end{schema}

\begin{theorem}{lQueueReceiveW\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; que?: QUEUE; topReady!: TASK | running\_task \notin  \dom  release\_snd \land  (running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)) \land  que? \in  queue \land  q\_size(que?) > 0 \land  topReady! \in  wait\_snd \inv  \limg  \{que?\} \rimg  \land  (\forall  wsnt: wait\_snd \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wsnt)) \land  priority(running\_task) \geq  priority(topReady!) \land  running\_task \notin  \dom  release\_mutex \land  que? \notin  mutex \cup  semaphore @ \lnot  (TaskQueueTimeMutex[q\_size := q\_size \oplus  \{(que?, (q\_size(que?) - 1))\}, release\_rcv := \{running\_task\} \ndres  release\_rcv, release\_snd := release\_snd \oplus  \{(topReady!, que?)\}, state := state \oplus  \{(topReady!, ready)\}, time := \{topReady!\} \ndres  time, wait\_snd := \{topReady!\} \ndres  wait\_snd] \land  priority(topReady!) \leq  priority(running\_task) \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topReady!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topReady!, ready)\}) st) \in  transition) \implies  ws \in  \dom  wait\_snd \land  wait\_snd(ws) = que? \land  \lnot  priority(topReady!) \geq  priority(ws))
\end{theorem}

\begin{zproof}[lQueueReceiveW\_TQTM\_Lemma]
use mutexDiffQue[que? := wait\_snd(topReady!)];
use lQueueReceiveW\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate wsnt\_\_0 == wsnt;
instantiate wsnt\_\_0 == ws;
instantiate ms\_\_0 == ms;
with enabled (inRan) prove;
cases;
apply inPower to predicate release\_mutex \in  \power  (\{running\_task\} \ndres  release\_rcv);
prove;
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
instantiate e\_\_0 == e;
apply inDom to predicate running\_task \in  \dom  release\_mutex;
instantiate y == e.2;
prove;
invoke (\_\pfun \_);
invoke (\_\rel \_);
prove;
apply inPower to predicate release\_mutex \in  \power  (TASK \cross  QUEUE);
instantiate e\_\_0 == e;
prove;
next;
instantiate x\_\_3 == x\_\_0;
instantiate x\_\_4 == x;
prove;
apply oplusDef to expression release\_snd \oplus  \{(topReady!, wait\_snd(topReady!))\};
prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{QueueReceiveW\_TQTM\_vc\_ref}
\forall  QueueReceiveW\_TQTMFSBSig | true @ \pre  QueueReceiveW\_TQTM
\end{theorem}

\begin{zproof}[QueueReceiveW\_TQTM\_vc\_ref]
use findDelegate[a := wait\_snd \inv  \limg  \{que?\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate topReady! == f (wait\_snd \inv  \limg  \{que?\} \rimg );
prove;
use lQueueReceiveW\_TQTM\_Lemma[topReady! := f (wait\_snd \inv  \limg  \{que?\} \rimg )];
prove;
instantiate ws\_\_0 == f (wait\_snd \inv  \limg  \{que?\} \rimg );
instantiate t == wsnt;
with normalization rewrite;
\end{zproof}

\begin{schema}{QueueReceiveWS\_TQTM}
  \Delta TaskQueueTimeMutex\\
  QueueReceiveWS\_TQT
\where
  running\_task \notin  \dom  release\_mutex\\
  que? \notin  mutex \cup  semaphore\\
  \Xi Mutex
\end{schema}

\begin{schema}{QueueReceiveWS\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  QueueReceiveWS\_TQTFSBSig
\where
  running\_task \notin  \dom  release\_mutex\\
  que? \notin  mutex \cup  semaphore
\end{schema}

\begin{theorem}{lQueueReceiveWS\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; que?: QUEUE; topReady!: TASK | running\_task \notin  \dom  release\_snd \land  (running\_task \in  \dom  release\_rcv \implies  que? = release\_rcv(running\_task)) \land  que? \in  queue \land  q\_size(que?) > 0 \land  topReady! \in  wait\_snd \inv  \limg  \{que?\} \rimg  \land  (\forall  wsnt: wait\_snd \inv  \limg  \{que?\} \rimg  @ priority(topReady!) \geq  priority(wsnt)) \land  priority(topReady!) > priority(running\_task) \land  running\_task \notin  \dom  release\_mutex \land  que? \notin  mutex \cup  semaphore @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), q\_size := q\_size \oplus  \{(wait\_snd(topReady!), (q\_size (wait\_snd(topReady!)) - 1))\}, release\_rcv := \{running\_task\} \ndres  release\_rcv, release\_snd := release\_snd \oplus  \{(topReady!, wait\_snd(topReady!))\}, running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\}), time := \{topReady!\} \ndres  time, wait\_snd := \{topReady!\} \ndres  wait\_snd] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  ws \in  \dom  wait\_snd \land  wait\_snd(ws) = wait\_snd(topReady!) \land  \lnot  priority(topReady!) \geq  priority(ws))
\end{theorem}

\begin{zproof}[lQueueReceiveWS\_TQTM\_Lemma]
use mutexDiffQue[que? := wait\_snd(topReady!)];
use lQueueReceiveWS\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate wsnt\_\_0 == wsnt;
instantiate wsnt\_\_0 == ws;
instantiate ms\_\_0 == ms;
with enabled (inRan) prove;
cases;
apply inPower to predicate release\_mutex \in  \power  (\{running\_task\} \ndres  release\_rcv);
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
apply inDom to predicate running\_task \in  \dom  release\_mutex;
prove;
instantiate y == e.2;
invoke (\_\pfun \_);
invoke (\_\rel \_);
prove;
apply inPower to predicate release\_mutex \in  \power  (TASK \cross  QUEUE);
instantiate e\_\_0 == e;
prove;
next;
instantiate x\_\_4 == x;
instantiate x\_\_3 == x\_\_0;
apply oplusDef to expression release\_snd \oplus  \{(topReady!, wait\_snd(topReady!))\};
prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{QueueReceiveWS\_TQTM\_vc\_ref}
\forall  QueueReceiveWS\_TQTMFSBSig | true @ \pre  QueueReceiveWS\_TQTM
\end{theorem}

\begin{zproof}[QueueReceiveWS\_TQTM\_vc\_ref]
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == topReady!;
prove;
use lQueueReceiveWS\_TQTM\_Lemma;
prove;
instantiate ws\_\_0 == wsnt;
prove;
with normalization rewrite;
\end{zproof}

\begin{zed}
QueueReceive\_TQTM \defs QueueReceiveN\_TQTM \lor  QueueReceiveE\_TQTM \lor  QueueReceiveW\_TQTM \lor  QueueReceiveWS\_TQTM
\end{zed}

\begin{zed}
DelayUntil\_TQTM \defs ExtendTQTXi \land  DelayUntil\_TQT
\end{zed}

\begin{zed}
DelayUntil\_TQTMFSBSig \defs TaskQueueTimeMutex \land  DelayUntil\_TQTFSBSig
\end{zed}

\begin{theorem}{lDelayUntil\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; n?: \nat ; topReady!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  running\_task \neq  idle \land  state(topReady!) = ready \land  n? > clock \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (TaskQueueTimeMutex[delayed\_task := delayed\_task \cup  \{running\_task\}, log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\}), time := time \oplus  \{(running\_task, n?)\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lDelayUntil\_TQTM\_Lemma]
use lDelayUntil\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
instantiate rtsk\_\_0 == t;
prove;
\end{zproof}

\begin{theorem}{DelayUntil\_TQTM\_vc\_ref}
\forall  DelayUntil\_TQTMFSBSig | true @ \pre  DelayUntil\_TQTM
\end{theorem}

\begin{zproof}[DelayUntil\_TQTM\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lDelayUntil\_TQTM\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
\end{zproof}

\begin{zed}
CheckDelayedTaskN\_TQTM \defs ExtendTQTXi \land  CheckDelayedTaskN\_TQT
\end{zed}

\begin{zed}
CheckDelayedTaskN\_TQTMFSBSig \defs TaskQueueTimeMutex \land  CheckDelayedTaskN\_TQTFSBSig
\end{zed}

\begin{theorem}{lCheckDelayedTaskN\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topWaiting!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  topWaiting! \in  \dom  time \land  (\forall  dtk: \dom  time @ time(topWaiting!) \leq  time(dtk)) \land  (\forall  detk: \dom  time | time(detk) = time(topWaiting!) @ priority(topWaiting!) \geq  priority(detk)) \land  priority(topWaiting!) \leq  priority(running\_task) @ \lnot  (TaskQueueTimeMutex[clock := time(topWaiting!), delayed\_task := delayed\_task \setminus  \{topWaiting!\}, state := state \oplus  \{(topWaiting!, ready)\}, time := \{topWaiting!\} \ndres  time, wait\_rcv := \{topWaiting!\} \ndres  wait\_rcv, wait\_snd := \{topWaiting!\} \ndres  wait\_snd] \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topWaiting!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topWaiting!, ready)\}) st) \in  transition) \land  (wt \in  \dom  time \implies  time(topWaiting!) \leq  time(wt)) \implies  wt\_\_0 \in  \dom  time \land  time(wt\_\_0) = time(topWaiting!) \land  \lnot  priority(topWaiting!) \geq  priority(wt\_\_0))
\end{theorem}

\begin{zproof}[lCheckDelayedTaskN\_TQTM\_Lemma]
use lCheckDelayedTaskN\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate dtk\_\_0 == dtk;
instantiate detk\_\_0 == detk;
instantiate dtk\_\_0 == wt;
instantiate detk\_\_0 == wt\_\_0;
instantiate ms\_\_0 == ms;
with enabled (inRan) prove;
instantiate x\_\_3 == x;
prove;
\end{zproof}

\begin{theorem}{CheckDelayedTaskN\_TQTM\_vc\_ref}
\forall  CheckDelayedTaskN\_TQTMFSBSig | true @ \pre  CheckDelayedTaskN\_TQTM
\end{theorem}

\begin{zproof}[CheckDelayedTaskN\_TQTM\_vc\_ref]
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate topWaiting\_\_0! == topWaiting!;
prove;
use lCheckDelayedTaskN\_TQTM\_Lemma;
prove;
instantiate wt\_\_1 == dtk;
instantiate wt\_\_2 == detk;
with normalization rewrite;
\end{zproof}

\begin{zed}
CheckDelayedTaskS\_TQTM \defs ExtendTQTXi \land  CheckDelayedTaskS\_TQT
\end{zed}

\begin{zed}
CheckDelayedTaskS\_TQTMFSBSig \defs TaskQueueTimeMutex \land  CheckDelayedTaskS\_TQTFSBSig
\end{zed}

\begin{theorem}{lCheckDelayedTaskS\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topWaiting!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  topWaiting! \in  \dom  time \land  (\forall  dtk: \dom  time @ time(topWaiting!) \leq  time(dtk)) \land  (\forall  detk: \dom  time | time(detk) = time(topWaiting!) @ priority(topWaiting!) \geq  priority(detk)) \land  priority(topWaiting!) > priority(running\_task) @ \lnot  (time(topWaiting!) \in  \num  \land  TaskQueueTimeMutex[clock := time(topWaiting!), delayed\_task := delayed\_task \setminus  \{topWaiting!\}, log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topWaiting!), running\_task := topWaiting!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\}), time := \{topWaiting!\} \ndres  time, wait\_rcv := \{topWaiting!\} \ndres  wait\_rcv, wait\_snd := \{topWaiting!\} \ndres  wait\_snd] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topWaiting!, running)\})) st) \in  transition) \land  (wt \in  \dom  time \implies  time(topWaiting!) \leq  time(wt)) \implies  wt\_\_0 \in  \dom  time \land  time(wt\_\_0) = time(topWaiting!) \land  \lnot  priority(topWaiting!) \geq  priority(wt\_\_0))
\end{theorem}

\begin{zproof}[lCheckDelayedTaskS\_TQTM\_Lemma]
use lCheckDelayedTaskS\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate dtk\_\_0 == dtk;
instantiate detk\_\_0 == detk;
instantiate dtk\_\_0 == wt;
instantiate detk\_\_0 == wt\_\_0;
instantiate ms\_\_0 == ms;
with enabled (inRan) prove;
invoke predicate TaskQueueTime;
invoke Time;
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := time, a := topWaiting!];
instantiate x\_\_3 == x;
prove;
\end{zproof}

\begin{theorem}{CheckDelayedTaskS\_TQTM\_vc\_ref}
\forall  CheckDelayedTaskS\_TQTMFSBSig | true @ \pre  CheckDelayedTaskS\_TQTM
\end{theorem}

\begin{zproof}[CheckDelayedTaskS\_TQTM\_vc\_ref]
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == topWaiting!;
prove;
use lCheckDelayedTaskS\_TQTM\_Lemma;
prove;
instantiate wt\_\_1 == dtk;
instantiate wt\_\_2 == detk;
with normalization rewrite;
\end{zproof}

\begin{zed}
TimeSlicing\_TQTM \defs ExtendTQTXi \land  TimeSlicing\_TQT
\end{zed}

\begin{zed}
TimeSlicing\_TQTMFSBSig \defs TaskQueueTimeMutex \land  TimeSlicing\_TQTFSBSig
\end{zed}

\begin{theorem}{lTimeSlicing\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topReady!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  state(topReady!) = ready \land  priority(topReady!) = priority(running\_task) \land  (\forall  ts: \dom  time @ time\_slice \leq  time(ts)) @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), running\_task := topReady!, state := state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\}), time\_slice := time\_slice + slice\_delay] \implies  st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st = state(st) \land  \lnot  (state(st), (state \oplus  (\{(running\_task, ready)\} \cup  \{(topReady!, running)\})) st) \in  transition)
\end{theorem}

\begin{zproof}[lTimeSlicing\_TQTM\_Lemma]
use lTimeSlicing\_TQT\_Lemma;
with disabled (TaskQueueTime) prove by reduce;
instantiate ts\_\_0 == ts;
prove;
\end{zproof}

\begin{theorem}{TimeSlicing\_TQTM\_vc\_ref}
\forall  TimeSlicing\_TQTMFSBSig | true @ \pre  TimeSlicing\_TQTM
\end{theorem}

\begin{zproof}[TimeSlicing\_TQTM\_vc\_ref]
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == topReady!;
prove;
use lTimeSlicing\_TQTM\_Lemma;
prove;
instantiate t == ts;
prove;
\end{zproof}

\begin{zed}
NoSlicing\_TQTM \defs ExtendTQTXi \land  NoSlicing\_TQT
\end{zed}

\begin{zed}
NoSlicing\_TQTMFSBSig \defs TaskQueueTimeMutex \land  NoSlicing\_TQTFSBSig
\end{zed}

\begin{theorem}{NoSlicing\_TQTM\_vc\_ref}
\forall  NoSlicing\_TQTMFSBSig | true @ \pre  NoSlicing\_TQTM
\end{theorem}

\begin{zproof}[NoSlicing\_TQTM\_vc\_ref]
use NoSlicing\_TQT\_vc\_ref;
with disabled (TaskQueueTime) prove by reduce;
\end{zproof}

\begin{schema}{CreateBinarySemaphore\_TQTM}
  \Delta TaskQueueTimeMutex\\
  sem?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  sem? \notin  queue\\
  \Xi Task\\
  queue' = queue \cup  \{sem?\}\\
  q\_max' = q\_max \oplus  \{(sem? \mapsto  1)\}\\
  q\_size' = q\_size \oplus  \{(sem? \mapsto  1)\}\\
  \Xi WaitingData\\
  \Xi QReleasingData\\
  \Xi Time\\
  semaphore' = semaphore \cup  \{sem?\}\\
  mutex' = mutex\\
  mutex\_holder' = mutex\_holder\\
  mutex\_recursive' = mutex\_recursive\\
  \Xi OriginalPrioData\\
  \Xi MReleasingData
\end{schema}

\begin{schema}{CreateBinarySemaphore\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  sem?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  sem? \notin  queue
\end{schema}

\begin{theorem}{CreateBinarySemaphore\_TQTM\_vc\_ref}
\forall  CreateBinarySemaphore\_TQTMFSBSig | true @ \pre  CreateBinarySemaphore\_TQTM
\end{theorem}

\begin{zproof}[CreateBinarySemaphore\_TQTM\_vc\_ref]
with disabled (Task, WaitingData, QReleasingData, Time, OriginalPrioData, MReleasingData) prove by reduce;
instantiate q\_\_0 == q;
instantiate s\_\_0 == s;
instantiate m\_\_1 == m;
instantiate ms\_\_0 == ms;
apply inPower to predicate \dom  mutex\_recursive \in  \power  (\dom  q\_size);
prove;
cases;
apply extensionality to predicate (semaphore \cup  \{sem?\}) \cap  \dom  mutex\_recursive = \{\};
apply extensionality to predicate semaphore \cap  \dom  mutex\_recursive = \{\};
prove;
instantiate x\_\_0 == x;
instantiate e == x;
with normalization rewrite;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(sem?, 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
instantiate e == x;
prove;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
apply inPower to predicate semaphore \in  \power  (\dom  q\_size);
instantiate e == s;
with normalization rewrite;
next;
instantiate e == m;
with enabled (applyOverride) prove;
next;
apply inPower to predicate \ran  release\_snd \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  wait\_snd \in  \power  (\dom  q\_size);
instantiate e\_\_0 == ms;
instantiate e\_\_1 == ms;
with normalization rewrite;
next;
\end{zproof}

\begin{schema}{DeleteBinarySemaphore\_TQTM}
  \Delta TaskQueueTimeMutex\\
  sem?: QUEUE
\where
  sem? \in  semaphore\\
  DeleteQueue\_TQT[sem?/que?]\\
  semaphore' = semaphore \setminus  \{sem?\}\\
  mutex' = mutex\\
  mutex\_holder' = mutex\_holder\\
  mutex\_recursive' = mutex\_recursive\\
  \Xi OriginalPrioData\\
  \Xi MReleasingData
\end{schema}

\begin{schema}{DeleteBinarySemaphore\_TQTMFSBSig}
  DeleteQueue\_TQTFSBSig[sem?/que?]\\
  TaskQueueTimeMutex\\
  sem?: QUEUE
\where
  sem? \in  semaphore
\end{schema}

\begin{theorem}{DeleteBinarySemaphore\_TQTM\_vc\_ref}
\forall  DeleteBinarySemaphore\_TQTMFSBSig | true @ \pre  DeleteBinarySemaphore\_TQTM
\end{theorem}

\begin{zproof}[DeleteBinarySemaphore\_TQTM\_vc\_ref]
use DeleteQueue\_TQT\_vc\_ref[que? := sem?];
with disabled (TaskQueueTime, OriginalPrioData, MReleasingData) prove by reduce;
instantiate s\_\_0 == s;
instantiate m\_\_1 == m;
instantiate ms\_\_0 == ms;
apply inPower to predicate semaphore \setminus  \{sem?\} \in  \power  (queue \setminus  \{sem?\});
apply inPower to predicate \dom  mutex\_recursive \in  \power  (queue \setminus  \{sem?\});
apply inPower to predicate semaphore \in  \power  queue;
apply inPower to predicate \dom  mutex\_recursive \in  \power  queue;
apply extensionality to predicate semaphore \cap  \dom  mutex\_recursive = \{\};
prove;
instantiate x == sem?;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Queue;
invoke QueueData;
apply extensionality to predicate (semaphore \setminus  \{sem?\}) \cap  \dom  mutex\_recursive = \{\};
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} = \{  f\_\_1: \dom  mutex\_recursive | (\{sem?\} \ndres  q\_size) f\_\_1 = 0 \};
instantiate e\_\_1 == e;
instantiate e\_\_2 == e\_\_0;
instantiate e\_\_1 == s;
instantiate e\_\_2 == m;
prove;
instantiate x\_\_0 == x;
split \lnot  ms = sem?;
prove;
\end{zproof}

\begin{schema}{CreateMutex\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \notin  queue\\
  \Xi Task\\
  queue' = queue \cup  \{mut?\}\\
  q\_max' = q\_max \oplus  \{(mut? \mapsto  1)\}\\
  q\_size' = q\_size \oplus  \{(mut? \mapsto  1)\}\\
  \Xi WaitingData\\
  \Xi QReleasingData\\
  \Xi Time\\
  semaphore' = semaphore\\
  mutex' = mutex \cup  \{mut?\}\\
  mutex\_holder' = mutex\_holder\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  0)\}\\
  \Xi OriginalPrioData\\
  \Xi MReleasingData
\end{schema}

\begin{schema}{CreateMutex\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \notin  queue
\end{schema}

\begin{theorem}{CreateMutex\_TQTM\_vc\_ref}
\forall  CreateMutex\_TQTMFSBSig | true @ \pre  CreateMutex\_TQTM
\end{theorem}

\begin{zproof}[CreateMutex\_TQTM\_vc\_ref]
with disabled (Task, WaitingData, QReleasingData, Time, OriginalPrioData, MReleasingData) prove by reduce;
instantiate q\_\_0 == q;
instantiate s\_\_0 == s;
instantiate m\_\_1 == m;
instantiate m\_\_2 == m\_\_0;
instantiate ms\_\_0 == ms;
apply inPower to predicate semaphore \in  \power  (\dom  q\_size);
prove;
cases;
apply extensionality to predicate semaphore \cap  (\{mut?\} \cup  \dom  mutex\_recursive) = \{\};
apply extensionality to predicate semaphore \cap  \dom  mutex\_recursive = \{\};
prove;
instantiate x\_\_0 == x;
instantiate e == x;
with normalization rewrite;
next;
apply inPower to predicate \dom  mutex\_recursive \in  \power  (\dom  q\_size);
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} = \{  f\_\_1: \{mut?\} \cup  \dom  mutex\_recursive | (q\_size \oplus  \{(mut?, 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
instantiate e\_\_0 == x;
instantiate e\_\_0 == y;
prove;
split y = mut?;
apply applyOverride to expression (q\_size \oplus  \{(mut?, 1)\}) y;
prove;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
split m = mut?;
prove;
next;
instantiate e == s;
prove;
next;
apply inPower to predicate \dom  mutex\_recursive \in  \power  (\dom  q\_size);
instantiate e\_\_0 == m\_\_0;
with normalization rewrite;
next;
apply inPower to predicate \ran  release\_snd \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  wait\_snd \in  \power  (\dom  q\_size);
instantiate e\_\_0 == ms;
instantiate e\_\_1 == ms;
with normalization rewrite;
next;
\end{zproof}

\begin{schema}{DeleteMutex\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  mut? \in  mutex \setminus  \dom  mutex\_holder\\
  DeleteQueue\_TQT[que? := mut?]\\
  semaphore' = semaphore\\
  mutex' = mutex \setminus  \{mut?\}\\
  mutex\_holder' = mutex\_holder\\
  mutex\_recursive' = \{mut?\} \ndres  mutex\_recursive\\
  \Xi OriginalPrioData\\
  \Xi MReleasingData
\end{schema}

\begin{schema}{DeleteMutex\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  DeleteQueue\_TQTFSBSig[que? := mut?]\\
  mut? \in  mutex \setminus  \dom  mutex\_holder
\end{schema}

\begin{theorem}{subPfun}[X, Y]
\forall  f, g: X \pfun  Y; y: Y | g \subseteq  f @ y \notin  \ran  f \implies  y \notin  \ran  g
\end{theorem}

\begin{zproof}[subPfun]
prove;
apply inRan to predicate y \in  \ran [X, Y] f;
apply inRan to predicate y \in  \ran [X, Y] g;
prove;
instantiate x\_\_0 == x;
prove;
apply inPower to predicate g \in  \power  f;
instantiate e == (x, y);
prove;
\end{zproof}

\begin{theorem}{DeleteMutex\_TQTM\_vc\_ref}
\forall  DeleteMutex\_TQTMFSBSig | true @ \pre  DeleteMutex\_TQTM
\end{theorem}

\begin{zproof}[DeleteMutex\_TQTM\_vc\_ref]
use DeleteQueue\_TQT\_vc\_ref[que? := mut?];
with disabled (TaskQueueTime, OriginalPrioData, MReleasingData) prove by reduce;
instantiate s\_\_0 == s;
instantiate m\_\_1 == m;
instantiate m\_\_2 == m\_\_0;
instantiate ms\_\_0 == ms;
apply inPower to predicate semaphore \in  \power  (queue \setminus  \{mut?\});
apply inPower to predicate \dom  mutex\_recursive \setminus  \{mut?\} \in  \power  (queue \setminus  \{mut?\});
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive \setminus  \{mut?\});
apply inPower to predicate semaphore \in  \power  queue;
apply inPower to predicate \dom  mutex\_recursive \in  \power  queue;
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
apply extensionality to predicate semaphore \cap  \dom  mutex\_recursive = \{\};
prove;
instantiate x == mut?;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Queue;
invoke QueueData;
apply extensionality to predicate semaphore \cap  (\dom  mutex\_recursive \setminus  \{mut?\}) = \{\};
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} = \{  f\_\_1: \dom  mutex\_recursive \setminus  \{mut?\} | (\{mut?\} \ndres  q\_size) f\_\_1 = 0 \};
instantiate e\_\_2 == e;
instantiate e\_\_4 == e\_\_0;
instantiate e\_\_3 == e\_\_1;
instantiate e\_\_2 == s;
instantiate e\_\_3 == m;
instantiate e\_\_3 == m\_\_0;
use ranSubset[TASK, QUEUE][S := release\_rcv, R := release\_mutex];
apply inPower to predicate \ran  release\_mutex \in  \power  (\ran  release\_rcv);
instantiate e\_\_2 == mut?;
prove;
cases;
instantiate x\_\_0 == x;
prove;
next;
instantiate e\_\_3 == y\_\_0;
apply applyNdres to expression (\{mut?\} \ndres  q\_size) y;
split y = mut?;
prove;
next;
split ms = mut?;
prove;
next;
\end{zproof}

\begin{schema}{MutexTakeNnonInh\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK
\where
  running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex\\
  mut? \in  mutex\\
  running\_task \notin  \dom  base\_priority\\
  QueueReceiveN\_TQT[que? := mut?]\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = mutex\_holder \oplus  \{(mut? \mapsto  running\_task)\}\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  mutex\_recursive(mut?) + 1)\}\\
  base\_priority' = base\_priority \oplus  \{(running\_task \mapsto  priority(running\_task))\}\\
  release\_mutex' = \{running\_task\} \ndres  release\_mutex
\end{schema}

\begin{zproof}[MutexTakeNnonInh\_TQTM\$domainCheck]
with disabled (TaskQueueTime) prove by reduce;
\end{zproof}

\begin{schema}{MutexTakeNnonInh\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  QueueReceiveN\_TQTFSBSig[que? := mut?]\\
  running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex\\
  mut? \in  mutex\\
  running\_task \notin  \dom  base\_priority
\end{schema}

\begin{theorem}{MutexTakeNnonInh\_TQTM\_vc\_ref}
\forall  MutexTakeNnonInh\_TQTMFSBSig | true @ \pre  MutexTakeNnonInh\_TQTM
\end{theorem}

\begin{zproof}[MutexTakeNnonInh\_TQTM\_vc\_ref]
use QueueReceiveN\_TQT\_vc\_ref[que? := mut?];
with disabled (TaskQueueTime) prove by reduce;
apply cupSubsetLeft to expression \{mut?\} \cup  \dom  mutex\_recursive;
use applyInRanPfun[QUEUE, \num ][A := QUEUE, B := \nat , f := mutex\_recursive, a := mut?];
use applyInRanFun[TASK, \nat ][f := priority, a := running\_task];
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x == mut?;
prove;
apply extensionality to predicate \{running\_task\} \cup  \dom  base\_priority = \ran  (mutex\_holder \oplus  \{(mut?, running\_task)\});
instantiate m\_\_1 == m;
instantiate m\_\_2 == m\_\_0;
instantiate m\_\_2 == mut?;
instantiate mh\_\_0 == mh;
instantiate ms\_\_0 == ms;
prove;
cases;
apply inPower to predicate \ran  (\{running\_task\} \ndres  release\_mutex) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{running\_task\} \ndres  release\_mutex];
prove;
next;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Queue;
invoke QueueData;
instantiate q == mut?;
prove;
apply extensionality to predicate \{mut?\} \cup  \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(mut?, 0)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
split x = mut?;
prove;
next;
apply inPower to predicate \ran  (mutex\_holder \oplus  \{(mut?, running\_task)\}) \in  \power  tasks;
apply inPower to predicate \ran  mutex\_holder \in  \power  tasks;
prove;
instantiate e\_\_0 == e;
apply inRan to predicate e \in  \ran  (mutex\_holder \oplus  \{(mut?, running\_task)\});
prove;
apply inRan to predicate e \in  \ran  mutex\_holder;
instantiate x\_\_1 == x;
apply oplusDef to expression mutex\_holder \oplus  \{(mut?, running\_task)\};
prove;
split x = mut?;
prove;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Task;
invoke TaskData;
prove;
next;
apply inPower to predicate \{running\_task\} \ndres  release\_mutex \in  \power  (\{running\_task\} \ndres  release\_rcv);
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
prove;
next;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate x\_\_0 == x;
use overrideIsAppend[QUEUE, TASK][f := mutex\_holder, g := \{(mut?, running\_task)\}];
use ranSubset[QUEUE, TASK][S := mutex\_holder \oplus  \{(mut?, running\_task)\}, R := mutex\_holder];
prove;
apply inPower to predicate \ran  mutex\_holder \in  \power  (\ran  (mutex\_holder \oplus  \{(mut?, running\_task)\}));
instantiate e == x;
prove;
split x \in  \dom  base\_priority;
with enabled (oplusDef) prove;
next;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate y\_\_0 == y;
with enabled (oplusDef) prove;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{mut?\} \ndres  mutex\_holder];
prove;
next;
split m = mut?;
prove;
instantiate y == m;
instantiate x == m;
prove;
next;
with enabled (oplusDef) prove;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{mut?\} \ndres  mutex\_holder];
split mh \in  \ran  (\{mut?\} \ndres  mutex\_holder);
prove;
apply applyCupRight to expression (\{(running\_task, priority(running\_task))\} \cup  \{running\_task\} \ndres  base\_priority) mh;
prove;
next;
\end{zproof}

\begin{schema}{MutexTakeNInh\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK
\where
  running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex\\
  mut? \in  mutex\\
  running\_task \in  \dom  base\_priority\\
  QueueReceiveN\_TQT[que? := mut?]\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = mutex\_holder \oplus  \{(mut? \mapsto  running\_task)\}\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  mutex\_recursive(mut?) + 1)\}\\
  \Xi OriginalPrioData\\
  release\_mutex' = \{running\_task\} \ndres  release\_mutex
\end{schema}

\begin{zproof}[MutexTakeNInh\_TQTM\$domainCheck]
invoke \Delta TaskQueueTimeMutex;
invoke predicate TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
prove;
\end{zproof}

\begin{schema}{MutexTakeNInh\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  QueueReceiveN\_TQTFSBSig[que? := mut?]\\
  running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex\\
  mut? \in  mutex\\
  running\_task \in  \dom  base\_priority
\end{schema}

\begin{theorem}{MutexTakeNInh\_TQTM\_vc\_ref}
\forall  MutexTakeNInh\_TQTMFSBSig | true @ \pre  MutexTakeNInh\_TQTM
\end{theorem}

\begin{zproof}[MutexTakeNInh\_TQTM\_vc\_ref]
use QueueReceiveN\_TQT\_vc\_ref[que? := mut?];
with disabled (TaskQueueTime) prove by reduce;
apply cupSubsetLeft to expression \{mut?\} \cup  \dom  mutex\_recursive;
use applyInRanPfun[QUEUE, \num ][A := QUEUE, B := \nat , f := mutex\_recursive, a := mut?];
use applyInRanFun[TASK, \nat ][f := priority, a := running\_task];
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x == mut?;
prove;
apply extensionality to predicate \dom  base\_priority = \ran  (mutex\_holder \oplus  \{(mut?, running\_task)\});
instantiate m\_\_1 == m;
instantiate m\_\_2 == m\_\_0;
instantiate m\_\_2 == mut?;
instantiate ms\_\_0 == ms;
prove;
cases;
apply inPower to predicate \ran  (\{running\_task\} \ndres  release\_mutex) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{running\_task\} \ndres  release\_mutex];
prove;
next;
invoke predicate TaskQueueTime;
invoke TaskQueue;
invoke Queue;
invoke QueueData;
instantiate q == mut?;
prove;
apply extensionality to predicate \{mut?\} \cup  \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(mut?, 0)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
split x = mut?;
prove;
next;
apply inPower to predicate \{running\_task\} \ndres  release\_mutex \in  \power  (\{running\_task\} \ndres  release\_rcv);
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
prove;
next;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate x\_\_0 == x;
use ranSubset[QUEUE, TASK][S := mutex\_holder \oplus  \{(mut?, running\_task)\}, R := mutex\_holder];
use overrideIsAppend[QUEUE, TASK][f := mutex\_holder, g := \{(mut?, running\_task)\}];
prove;
apply inPower to predicate \ran  mutex\_holder \in  \power  (\ran  (mutex\_holder \oplus  \{(mut?, running\_task)\}));
instantiate e == x;
prove;
next;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate y\_\_0 == y;
with enabled (oplusDef) prove;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{mut?\} \ndres  mutex\_holder];
prove;
split y \in  \ran  (\{mut?\} \ndres  mutex\_holder);
prove;
next;
split m = mut?;
prove;
instantiate x == m;
instantiate y == m;
prove;
next;
\end{zproof}

\begin{schema}{MutexTakeRecursive\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  \Xi TaskQueueTime\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = mutex\_holder\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  mutex\_recursive(mut?) + 1)\}\\
  \Xi OriginalPrioData\\
  \Xi MReleasingData\\
  topReady! = running\_task
\end{schema}

\begin{zproof}[MutexTakeRecursive\_TQTM\$domainCheck]
invoke \Delta TaskQueueTimeMutex;
invoke predicate TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
prove;
\end{zproof}

\begin{schema}{MutexTakeRecursive\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)
\end{schema}

\begin{zproof}[MutexTakeRecursive\_TQTMFSBSig\$domainCheck]
invoke TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
prove;
\end{zproof}

\begin{theorem}{MutexTakeRecursive\_TQTM\_vc\_ref}
\forall  MutexTakeRecursive\_TQTMFSBSig | true @ \pre  MutexTakeRecursive\_TQTM
\end{theorem}

\begin{zproof}[MutexTakeRecursive\_TQTM\_vc\_ref]
with disabled (TaskQueueTime) prove by reduce;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x == mut?;
apply cupSubsetLeft to expression \{mut?\} \cup  \dom  mutex\_recursive;
instantiate m\_\_1 == m;
instantiate m\_\_2 == m\_\_0;
instantiate ms\_\_0 == ms;
with enabled (oplusDef) prove;
apply inPower to predicate \dom  mutex\_recursive \in  \power  queue;
instantiate e == mut?;
use applyInRanPfun[QUEUE, \num ][A := QUEUE, B := \nat , f := mutex\_recursive, a := mut?];
prove;
instantiate x == m;
instantiate y == m;
split m \in  \dom  mutex\_holder;
prove;
apply applyCupRight to expression (\{(mut?, 1 + mutex\_recursive(mut?))\} \cup  \{mut?\} \ndres  mutex\_recursive) m;
prove;
\end{zproof}

\begin{schema}{MutexTakeEnonInh\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK\\
  n?: \nat 
\where
  running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex\\
  mut? \in  \dom  mutex\_holder\\
  priority(running\_task) \leq  priority (mutex\_holder(mut?))\\
  running\_task \neq  mutex\_holder(mut?)\\
  QueueReceiveE\_TQT[que? := mut?]\\
  \Xi MutexData\\
  \Xi OriginalPrioData\\
  release\_mutex' = \{running\_task\} \ndres  release\_mutex
\end{schema}

\begin{zproof}[MutexTakeEnonInh\_TQTM\$domainCheck]
prove;
\end{zproof}

\begin{schema}{MutexTakeEnonInh\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE\\
  n?: \nat
\where
  QueueReceiveE\_TQTFSBSig[que? := mut?]\\
  running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex\\
  mut? \in  \dom  mutex\_holder\\
  priority(running\_task) \leq  priority (mutex\_holder(mut?))\\
  running\_task \neq  mutex\_holder(mut?)
\end{schema}

\begin{zproof}[MutexTakeEnonInh\_TQTMFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{lMutexTakeEnonInh\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; mut?: QUEUE; topReady!: TASK; n?: \nat  | running\_task \notin  \dom  release\_snd \land  (running\_task \in  \dom  release\_rcv \implies  mut? = release\_rcv(running\_task)) \land  mut? \in  queue \land  q\_size(mut?) = 0 \land  running\_task \neq  idle \land  topReady! \in  state \inv  \limg  \{ready\} \rimg  \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  n? > clock \land  (running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex) \land  mut? \in  \dom  mutex\_holder \land  q\_size(mut?) = 0 \land  priority(running\_task) \leq  priority (mutex\_holder(mut?)) \land  running\_task \neq  mutex\_holder(mut?) @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), release\_mutex := \{running\_task\} \ndres  release\_mutex, release\_rcv := \{running\_task\} \ndres  release\_rcv, running\_task := topReady!, state := state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\}), time := time \oplus  \{(running\_task, n?)\}, wait\_rcv := wait\_rcv \oplus  \{(running\_task, mut?)\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  t \in  TASK \land  state(t) = ready \land  \lnot  priority(topReady!) \geq  priority(t))
\end{theorem}

\begin{zproof}[lMutexTakeEnonInh\_TQTM\_Lemma]
use lQueueReceiveE\_TQT\_Lemma[que? := mut?];
with disabled (TaskQueueTime) prove by reduce;
instantiate rtsk\_\_0 == rtsk;
instantiate rtsk\_\_0 == t;
prove;
apply inPower;
prove;
instantiate e\_\_5 == e;
instantiate e\_\_3 == e\_\_0;
prove;
cases;
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{running\_task\} \ndres  release\_mutex];
prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{MutexTakeEnonInh\_TQTM\_vc\_ref}
\forall  MutexTakeEnonInh\_TQTMFSBSig | true @ \pre  MutexTakeEnonInh\_TQTM
\end{theorem}

\begin{zproof}[MutexTakeEnonInh\_TQTM\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex, TaskQueueTime) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lMutexTakeEnonInh\_TQTM\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t\_\_0 == rtsk;
prove;
\end{zproof}

\begin{schema}{MutexTakeEInheritHolder\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK\\
  n?: \nat 
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  mut? = release\_rcv(running\_task)\\
  running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex\\
  mut? \in  \dom  mutex\_holder\\
  priority(running\_task) > priority (mutex\_holder(mut?))\\
  n? > clock\\
  mutex\_holder(mut?) \in  state \inv  \limg  \{ready\} \rimg \\
  topReady! = mutex\_holder(mut?)\\
  topReady! \neq  idle\\
  \exists  st?: STATE; pri?: TASK \fun  \nat  | st? = blocked \land  pri? = priority \oplus  \{(topReady! \mapsto  priority(running\_task))\} @ Reschedule[topReady!/target?, tasks/tasks?]\\
  \Xi QueueData\\
  wait\_snd' = wait\_snd\\
  wait\_rcv' = wait\_rcv \oplus  \{(running\_task \mapsto  mut?)\}\\
  release\_snd' = release\_snd\\
  release\_rcv' = \{running\_task\} \ndres  release\_rcv\\
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = time \oplus  \{(running\_task \mapsto  n?)\}\\
  time\_slice' = time\_slice\\
  \Xi MutexData\\
  \Xi OriginalPrioData\\
  release\_mutex' = \{running\_task\} \ndres  release\_mutex
\end{schema}

\begin{zproof}[MutexTakeEInheritHolder\_TQTM\$domainCheck]
prove;
\end{zproof}

\begin{schema}{MutexTakeEInheritHolder\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE\\
  n?: \nat 
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  mut? = release\_rcv(running\_task)\\
  running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex\\
  mut? \in  \dom  mutex\_holder\\
  priority(running\_task) > priority (mutex\_holder(mut?))\\
  n? > clock\\
  mutex\_holder(mut?) \neq  idle\\
  mutex\_holder(mut?) \in  state \inv  \limg  \{ready\} \rimg 
\end{schema}

\begin{zproof}[MutexTakeEInheritHolder\_TQTMFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{MutexTakeEInheritHolder\_TQTM\_vc\_ref}
\forall  MutexTakeEInheritHolder\_TQTMFSBSig | true @ \pre  MutexTakeEInheritHolder\_TQTM
\end{theorem}

\begin{zproof}[MutexTakeEInheritHolder\_TQTM\_vc\_ref]
with disabled (partitionDef) prove by reduce;
apply partitionDef to predicate \langle delayed\_task\rangle  \cat  (\langle \dom  wait\_snd\rangle  \cat  \langle ((state \inv  \limg  \{running\} \rimg ) \cup  \dom  wait\_rcv)\rangle ) \partition  \dom  time \cup  (state \inv  \limg  \{running\} \rimg );
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
use applyInRanFun[TASK, \nat ][f := priority, a := running\_task];
with disabled (partitionDef) with enabled (disjointCat) prove;
cases;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(mutex\_holder(mut?), running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate \{mutex\_holder(mut?)\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) \cup  (state \inv  \limg  \{running\} \rimg )) = TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg );
prove;
split x = mutex\_holder(mut?);
prove;
next;
apply applyOverride to expression (state \oplus  (\{(running\_task, blocked)\} \cup  \{(mutex\_holder(mut?), running)\})) idle;
prove;
next;
apply extensionality to predicate (state \oplus  (\{(running\_task, blocked)\} \cup  \{(mutex\_holder(mut?), running)\})) \inv  \limg  \{running\} \rimg  = \{mutex\_holder(mut?)\};
prove;
instantiate x\_\_0 == x;
apply applyOverride to expression (state \oplus  (\{(running\_task, blocked)\} \cup  \{(mutex\_holder(mut?), running)\})) x;
prove;
with normalization rewrite;
next;
apply extensionality to predicate \dom  wait\_snd \cap  ((state \inv  \limg  \{running\} \rimg ) \cup  \dom  wait\_rcv) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == x;
with normalization rewrite;
next;
apply extensionality to predicate \dom  release\_snd \cap  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply inPower to predicate \ran  (wait\_rcv \oplus  \{(running\_task, mut?)\}) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  wait\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
apply oplusDef to expression wait\_rcv \oplus  \{(running\_task, mut?)\};
use ranSubset[TASK, QUEUE][S := wait\_rcv, R := \{running\_task\} \ndres  wait\_rcv];
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
apply inPower to predicate \dom  mutex\_recursive \in  \power  (\dom  q\_size);
instantiate x\_\_0 == mut?;
instantiate e\_\_0 == mut?;
prove;
split e = mut?;
prove;
next;
apply inPower to predicate \ran  ((state \inv  \limg  \{running\} \rimg ) \ndres  release\_rcv) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  release\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := release\_rcv, R := (state \inv  \limg  \{running\} \rimg ) \ndres  release\_rcv];
prove;
next;
apply extensionality to predicate (\dom  release\_snd \cup  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg ))) \cap  ((state \inv  \limg  \{running\} \rimg ) \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd)) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
instantiate x\_\_0 == x;
prove;
split x \in  \dom  release\_snd;
prove;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(mutex\_holder(mut?), running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(mutex\_holder(mut?), running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
apply inPower to predicate \ran  ((state \inv  \limg  \{running\} \rimg ) \ndres  release\_mutex) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := release\_mutex, R := (state \inv  \limg  \{running\} \rimg ) \ndres  release\_mutex];
prove;
next;
apply inPower to predicate (state \inv  \limg  \{running\} \rimg ) \ndres  release\_mutex \in  \power  ((state \inv  \limg  \{running\} \rimg ) \ndres  release\_rcv);
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
prove;
next;
apply extensionality to predicate delayed\_task \cap  ((state \inv  \limg  \{running\} \rimg ) \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd)) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
prove;
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == x;
prove;
next;
prove;
next;
with enabled (applyOverride) prove;
split idle = running\_task;
prove;
use applyInRanFun[TASK, \nat ][f := priority, a := mutex\_holder(mut?)];
prove;
next;
instantiate pt\_\_0 == pt;
prove;
split pt = mutex\_holder(mut?);
prove;
split pt = running\_task;
prove;
next;
instantiate x == t;
instantiate t\_\_0 == t;
with disabled (partitionDef) prove;
split t \in  TASK \land  state(t) = running;
prove;
next;
instantiate mh\_\_0 == mh;
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
split st = running\_task;
prove;
invoke transition;
prove;
next;
\end{zproof}

\begin{schema}{MutexTakeEInheritReady\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK\\
  n?: \nat 
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  mut? = release\_rcv(running\_task)\\
  running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex\\
  mut? \in  \dom  mutex\_holder\\
  priority(running\_task) > priority (mutex\_holder(mut?))\\
  n? > clock\\
  mutex\_holder(mut?) \notin  state \inv  \limg  \{ready\} \rimg \\
  state(topReady!) = ready\\
  \forall  rt: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rt)\\
  \exists  st?: STATE; pri?: TASK \fun  \nat  | st? = blocked \land  pri? = priority \oplus  \{(mutex\_holder(mut?) \mapsto  priority(running\_task))\} @ Reschedule[topReady!/target?, tasks/tasks?]\\
  \Xi QueueData\\
  wait\_snd' = wait\_snd\\
  wait\_rcv' = wait\_rcv \oplus  \{(running\_task \mapsto  mut?)\}\\
  release\_snd' = release\_snd\\
  release\_rcv' = \{running\_task\} \ndres  release\_rcv\\
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = time \oplus  \{(running\_task \mapsto  n?)\}\\
  time\_slice' = time\_slice\\
  \Xi MutexData\\
  \Xi OriginalPrioData\\
  release\_mutex' = \{running\_task\} \ndres  release\_mutex
\end{schema}

\begin{zproof}[MutexTakeEInheritReady\_TQTM\$domainCheck]
prove;
\end{zproof}

\begin{schema}{MutexTakeEInheritReady\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE\\
  n?: \nat 
\where
  running\_task \notin  \dom  release\_snd\\
  running\_task \in  \dom  release\_rcv \implies  mut? = release\_rcv(running\_task)\\
  running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex\\
  mut? \in  \dom  mutex\_holder\\
  priority(running\_task) > priority (mutex\_holder(mut?))\\
  n? > clock\\
  mutex\_holder(mut?) \notin  state \inv  \limg  \{ready\} \rimg 
\end{schema}

\begin{zproof}[MutexTakeEInheritReady\_TQTMFSBSig\$domainCheck]
prove;
\end{zproof}

\begin{theorem}{lMutexTakeEInheritReady\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; mut?: QUEUE; topReady!: TASK; n?: \nat  | running\_task \notin  \dom  release\_snd \land  (running\_task \in  \dom  release\_rcv \implies  mut? = release\_rcv(running\_task)) \land  (running\_task \in  \dom  release\_rcv \implies  running\_task \in  \dom  release\_mutex) \land  mut? \in  \dom  mutex\_holder \land  priority(running\_task) > priority (mutex\_holder(mut?)) \land  n? > clock \land  mutex\_holder(mut?) \notin  state \inv  \limg  \{ready\} \rimg  \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(running\_task, phys\_context)\}, phys\_context := log\_context(topReady!), priority := priority \oplus  \{(mutex\_holder(mut?), priority(running\_task))\}, release\_mutex := \{running\_task\} \ndres  release\_mutex, release\_rcv := \{running\_task\} \ndres  release\_rcv, running\_task := topReady!, state := state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\}), time := time \oplus  \{(running\_task, n?)\}, wait\_rcv := wait\_rcv \oplus  \{(running\_task, mut?)\}] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  rt \in  TASK \land  state(rt) = ready \land  \lnot  priority(topReady!) \geq  priority(rt))
\end{theorem}

\begin{zproof}[lMutexTakeEInheritReady\_TQTM\_Lemma]
with disabled (partitionDef) prove by reduce;
apply partitionDef to predicate \langle delayed\_task\rangle  \cat  (\langle \dom  wait\_snd\rangle  \cat  \langle ((state \inv  \limg  \{running\} \rimg ) \cup  \dom  wait\_rcv)\rangle ) \partition  \dom  time \cup  (state \inv  \limg  \{running\} \rimg );
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{running\_task\};
use applyInRanFun[TASK, \nat ][f := priority, a := running\_task];
with disabled (partitionDef) with enabled (disjointCat) prove;
cases;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{running\_task\} \cup  (\{topReady!\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg )));
prove;
with normalization rewrite;
next;
with enabled (applyOverride) prove;
split state(idle) = ready;
prove;
instantiate x == idle;
use applyInRanFun[TASK, \nat ][f := priority, a := mutex\_holder(mut?)];
prove;
next;
apply extensionality to predicate (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
split x = running\_task;
prove;
split x = topReady!;
prove;
instantiate x\_\_0 == x;
apply applyOverride to expression (state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) x;
prove;
next;
apply extensionality to predicate \dom  wait\_snd \cap  ((state \inv  \limg  \{running\} \rimg ) \cup  \dom  wait\_rcv) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == x;
prove;
next;
apply extensionality to predicate \dom  release\_snd \cap  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply inPower to predicate \ran  (wait\_rcv \oplus  \{(running\_task, mut?)\}) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  wait\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
apply oplusDef to expression wait\_rcv \oplus  \{(running\_task, mut?)\};
use ranSubset[TASK, QUEUE][S := wait\_rcv, R := \{running\_task\} \ndres  wait\_rcv];
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
apply inPower to predicate \dom  mutex\_recursive \in  \power  (\dom  q\_size);
instantiate x\_\_0 == mut?;
instantiate e\_\_0 == mut?;
prove;
split e = mut?;
prove;
next;
apply inPower to predicate \ran  ((state \inv  \limg  \{running\} \rimg ) \ndres  release\_rcv) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  release\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := release\_rcv, R := (state \inv  \limg  \{running\} \rimg ) \ndres  release\_rcv];
prove;
next;
apply extensionality to predicate (\dom  release\_snd \cup  (\dom  release\_rcv \setminus  (state \inv  \limg  \{running\} \rimg ))) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
instantiate x\_\_0 == x;
prove;
split x \in  \dom  release\_rcv;
prove;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  ((state \oplus  (\{(running\_task, blocked)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
prove;
next;
apply inPower to predicate \ran  ((state \inv  \limg  \{running\} \rimg ) \ndres  release\_mutex) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := release\_mutex, R := (state \inv  \limg  \{running\} \rimg ) \ndres  release\_mutex];
prove;
next;
apply inPower to predicate (state \inv  \limg  \{running\} \rimg ) \ndres  release\_mutex \in  \power  ((state \inv  \limg  \{running\} \rimg ) \ndres  release\_rcv);
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
prove;
next;
apply extensionality to predicate delayed\_task \cap  ((state \inv  \limg  \{running\} \rimg ) \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd)) = \{\};
with enabled (disjointCat) prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
prove;
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == x;
prove;
next;
prove;
next;
with enabled (applyOverride) prove;
split idle = running\_task;
prove;
use applyInRanFun[TASK, \nat ][f := priority, a := mutex\_holder(mut?)];
prove;
next;
instantiate rtsk == pt;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate x == t;
instantiate t\_\_0 == t;
with disabled (partitionDef) prove;
split t \in  TASK \land  state(t) = running;
prove;
next;
instantiate mh\_\_0 == mh;
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
split st = running\_task;
prove;
invoke transition;
prove;
next;
instantiate rtsk == rt;
prove;
next;
\end{zproof}

\begin{theorem}{MutexTakeEInheritReady\_TQTM\_vc\_ref}
\forall  MutexTakeEInheritReady\_TQTMFSBSig | true @ \pre  MutexTakeEInheritReady\_TQTM
\end{theorem}

\begin{zproof}[MutexTakeEInheritReady\_TQTM\_vc\_ref]
use findDelegate[a := state \inv  \limg  \{ready\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
instantiate running\_task' == f (state \inv  \limg  \{ready\} \rimg );
prove;
use lMutexTakeEInheritReady\_TQTM\_Lemma[topReady! := f (state \inv  \limg  \{ready\} \rimg )];
prove;
instantiate t == rtsk;
prove;
with normalization rewrite;
\end{zproof}

\begin{schema}{basePriorityMan}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder) \implies  \Xi OriginalPrioData\\
  running\_task \notin  \ran  (\{mut?\} \ndres  mutex\_holder) \implies  base\_priority' = \{running\_task\} \ndres  base\_priority
\end{schema}

\begin{schema}{MutexGiveNRecursive\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) > 1\\
  \Xi TaskQueueTime\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = mutex\_holder\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  mutex\_recursive(mut?) - 1)\}\\
  \Xi OriginalPrioData\\
  \Xi MReleasingData\\
  topReady! = running\_task
\end{schema}

\begin{zproof}[MutexGiveNRecursive\_TQTM\$domainCheck]
invoke \Delta TaskQueueTimeMutex;
invoke predicate TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
prove;
\end{zproof}

\begin{schema}{MutexGiveNRecursive\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) > 1
\end{schema}

\begin{zproof}[MutexGiveNRecursive\_TQTMFSBSig\$domainCheck]
invoke TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
prove;
\end{zproof}

\begin{theorem}{MutexGiveNRecursive\_TQTM\_vc\_ref}
\forall  MutexGiveNRecursive\_TQTMFSBSig | true @ \pre  MutexGiveNRecursive\_TQTM
\end{theorem}

\begin{zproof}[MutexGiveNRecursive\_TQTM\_vc\_ref]
with disabled (TaskQueueTime, OriginalPrioData, MReleasingData) prove by reduce;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x == mut?;
instantiate m\_\_1 == m;
instantiate m\_\_2 == m\_\_0;
instantiate ms\_\_0 == ms;
prove;
apply inPower to predicate \dom  mutex\_recursive \in  \power  queue;
instantiate x == m;
instantiate e == mut?;
apply extensionality to predicate \{mut?\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
prove;
split x = mut?;
prove;
split m \in  \dom  mutex\_holder;
with enabled (applyOverride) prove;
instantiate y == m;
prove;
\end{zproof}

\begin{schema}{MutexGiveNnonInh\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  base\_priority(running\_task) = priority(running\_task)\\
  QueueSendN\_TQT[que? := mut?]\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = \{mut?\} \ndres  mutex\_holder\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  0)\}\\
  basePriorityMan\\
  \Xi MReleasingData
\end{schema}

\begin{zproof}[MutexGiveNnonInh\_TQTM\$domainCheck]
invoke \Delta TaskQueueTimeMutex;
invoke predicate TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{schema}{MutexGiveNnonInh\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  QueueSendN\_TQTFSBSig[que? := mut?]\\
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  base\_priority(running\_task) = priority(running\_task)
\end{schema}

\begin{zproof}[MutexGiveNnonInh\_TQTMFSBSig\$domainCheck]
invoke TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{theorem}{ranUnchanged}[X, Y]
\forall  f: X \pfun  Y; a: X | a \in  \dom  f \land  f(a) \in  \ran  (\{a\} \ndres  f) @ \ran  f = \ran  (\{a\} \ndres  f)
\end{theorem}

\begin{zproof}[ranUnchanged]
apply extensionality2 to predicate \ran [X, Y] f = \ran [X, Y] ((\_ \ndres \_) [X, Y] (\{a \}, f)); 
use ranSubset[X, Y][S := f, R := (\_ \ndres \_) [X, Y] (\{a \}, f)];
prove; 
apply inPower to predicate \ran [X, Y] f \in \power (\ran [X, Y] ((\_ \ndres \_) [X, Y] (\{a \}, f)));
with enabled (inRan) prove;
instantiate x\_\_1 == x;
instantiate x\_\_1 == x\_\_0;
use pairInFunction[X, Y][y := e];
prove;
\end{zproof}

\begin{theorem}{MutexGiveNnonInh\_TQTM\_vc\_ref}
\forall  MutexGiveNnonInh\_TQTMFSBSig | true @ \pre  MutexGiveNnonInh\_TQTM
\end{theorem}

\begin{zproof}[MutexGiveNnonInh\_TQTM\_vc\_ref]
use QueueSendN\_TQT\_vc\_ref[que? := mut?];
split running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder);
with disabled (TaskQueueTime, MReleasingData) prove by reduce;
prove;
cases;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate m\_\_1 == m;
instantiate m\_\_2 == m\_\_0;
instantiate ms\_\_0 == ms;
instantiate x == mut?;
prove;
cases;
apply extensionality to predicate \{mut?\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
with normalization rewrite;
next;
use ranUnchanged[QUEUE, TASK][f := mutex\_holder, a := mut?];
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{mut?\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(mut?, 1)\}) f\_\_1 = 0 \};
invoke predicate TaskQueueTime[running\_task := mutex\_holder(mut?)];
invoke TaskQueue;
invoke Queue;
invoke QueueData;
with enabled (applyOverride) prove;
next;
instantiate x == m;
instantiate y == m;
split m \in  \dom  mutex\_holder;
prove;
next;
use ranSubset[TASK, QUEUE][S := release\_snd, R := \{mutex\_holder(mut?)\} \ndres  release\_snd];
prove;
apply inPower to predicate \ran  (\{mutex\_holder(mut?)\} \ndres  release\_snd) \in  \power  (\ran  release\_snd);
instantiate e == ms;
prove;
next;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate m == m\_\_1;
instantiate m\_\_2 == m\_\_0;
instantiate mh\_\_0 == mh;
instantiate ms\_\_0 == ms;
instantiate x == mut?;
prove;
cases;
apply extensionality to predicate \{mut?\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
with normalization rewrite;
next;
apply extensionality to predicate \dom  base\_priority \setminus  \{mutex\_holder(mut?)\} = \ran  (\{mut?\} \ndres  mutex\_holder);
prove;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate x\_\_0 == x;
instantiate y\_\_0 == y;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{mut?\} \ndres  mutex\_holder];
apply inRan to predicate x \in  \ran  (\{mut?\} \ndres  mutex\_holder);
apply inRan to predicate x \in  \ran  mutex\_holder;
prove;
instantiate x\_\_3 == x\_\_0;
use pairInFunction[QUEUE, TASK][f := mutex\_holder, x := mut?, y := x];
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{mut?\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(mut?, 1)\}) f\_\_1 = 0 \};
invoke predicate TaskQueueTime[running\_task := mutex\_holder(mut?)];
invoke TaskQueue;
invoke Queue;
invoke QueueData;
with enabled (applyOverride) prove;
next;
instantiate x == m;
instantiate y == m;
split m \in  \dom  mutex\_holder;
prove;
next;
prove;
next;
use ranSubset[TASK, QUEUE][S := release\_snd, R := \{mutex\_holder(mut?)\} \ndres  release\_snd];
prove;
apply inPower to predicate \ran  (\{mutex\_holder(mut?)\} \ndres  release\_snd) \in  \power  (\ran  release\_snd);
instantiate e == ms;
prove;
next;
\end{zproof}

\begin{schema}{MutexGiveNInhN\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  mut? \notin  \ran  wait\_rcv\\
  base\_priority(running\_task) \neq  priority(running\_task)\\
  \forall  rt: state \inv  \limg  \{ready\} \rimg  @ base\_priority(running\_task) \geq  priority(rt)\\
  \Xi TaskData\\
  \Xi StateData\\
  \Xi ContextData\\
  priority' = priority \oplus  \{(running\_task \mapsto  base\_priority(running\_task))\}\\
  queue' = queue\\
  q\_max' = q\_max\\
  q\_size' = q\_size \oplus  \{(mut? \mapsto  1)\}\\
  \Xi WaitingData\\
  \Xi QReleasingData\\
  \Xi Time\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = \{mut?\} \ndres  mutex\_holder\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  0)\}\\
  basePriorityMan\\
  \Xi MReleasingData\\
  topReady! = running\_task
\end{schema}

\begin{zproof}[MutexGiveNInhN\_TQTM\$domainCheck]
invoke \Delta TaskQueueTimeMutex;
invoke predicate TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{schema}{MutexGiveNInhN\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  mut? \notin  \ran  wait\_rcv\\
  base\_priority(running\_task) \neq  priority(running\_task)\\
  \forall  rt: state \inv  \limg  \{ready\} \rimg  @ base\_priority(running\_task) \geq  priority(rt)
\end{schema}

\begin{zproof}[MutexGiveNInhN\_TQTMFSBSig\$domainCheck]
invoke TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{theorem}{MutexGiveNInhN\_TQTMF\_vc\_ref}
\forall  MutexGiveNInhN\_TQTMFSBSig | true @ \pre  MutexGiveNInhN\_TQTM
\end{theorem}

\begin{zproof}[MutexGiveNInhN\_TQTMF\_vc\_ref]
split running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder);
with disabled (TaskData, StateData, ContextData, WaitingData, QReleasingData, Time, MReleasingData) prove by reduce;
cases;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
apply inPower to predicate \dom  mutex\_recursive \in  \power  (\dom  q\_size);
instantiate x == mut?;
instantiate e == mut?;
prove;
cases;
apply extensionality to predicate \{mut?\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
with normalization rewrite;
next;
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := mutex\_holder(mut?)];
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
next;
with enabled (applyOverride) prove;
instantiate mh == idle;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{mutex\_holder(mut?)\};
instantiate x == idle;
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := idle];
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
split state(idle) = running;
prove;
next;
apply cupSubsetLeft to expression \{mut?\} \cup  \dom  q\_size;
prove;
next;
use ranUnchanged[QUEUE, TASK][f := mutex\_holder, a := mut?];
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{mut?\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(mut?, 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
next;
instantiate rt == pt;
with enabled (applyOverride) prove;
next;
instantiate q\_\_0 == q;
instantiate m\_\_0 == q;
split q = mut?;
with enabled (applyOverride) prove;
next;
instantiate m\_\_1 == m;
instantiate x == m;
instantiate y == m;
split m \in  \dom  mutex\_holder;
prove;
next;
instantiate m\_\_2 == m\_\_0;
prove;
next;
instantiate mh\_\_0 == mh;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{mut?\} \ndres  mutex\_holder];
with enabled (applyOverride) prove;
next;
instantiate ms\_\_0 == ms;
prove;
next;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
apply inPower to predicate \dom  mutex\_recursive \in  \power  (\dom  q\_size);
instantiate x == mut?;
instantiate e == mut?;
prove;
cases;
apply extensionality to predicate \{mut?\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
with normalization rewrite;
next;
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := mutex\_holder(mut?)];
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
next;
with enabled (applyOverride) prove;
instantiate mh == idle;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{mutex\_holder(mut?)\};
instantiate x == idle;
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := idle];
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
split state(idle) = running;
prove;
next;
apply cupSubsetLeft to expression \{mut?\} \cup  \dom  q\_size;
prove;
next;
apply extensionality to predicate \dom  base\_priority \setminus  (state \inv  \limg  \{running\} \rimg ) = \ran  (\{mut?\} \ndres  mutex\_holder);
prove;
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
instantiate x\_\_0 == x;
instantiate y\_\_0 == y;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{mut?\} \ndres  mutex\_holder];
apply inRan to predicate x \in  \ran  (\{mut?\} \ndres  mutex\_holder);
apply inRan to predicate x \in  \ran  mutex\_holder;
prove;
instantiate x\_\_3 == x\_\_0;
use pairInFunction[QUEUE, TASK][f := mutex\_holder, x := mut?, y := x];
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{mutex\_holder(mut?)\};
instantiate y\_\_0 == running\_task;
instantiate x\_\_1 == y;
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{mut?\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(mut?, 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
next;
instantiate rt == pt;
with enabled (applyOverride) prove;
next;
instantiate q\_\_0 == q;
instantiate m\_\_0 == q;
split q = mut?;
with enabled (applyOverride) prove;
next;
instantiate m\_\_1 == m;
instantiate x == m;
instantiate y == m;
split m \in  \dom  mutex\_holder;
prove;
next;
instantiate m\_\_2 == m\_\_0;
prove;
next;
instantiate mh\_\_0 == mh;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{mut?\} \ndres  mutex\_holder];
prove;
next;
instantiate ms\_\_0 == ms;
prove;
next;
\end{zproof}

\begin{schema}{MutexGiveNInhS\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  mut? \notin  \ran  wait\_rcv\\
  base\_priority(running\_task) \neq  priority(running\_task)\\
  state(topReady!) = ready\\
  \forall  rt: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rt)\\
  base\_priority(running\_task) < priority(topReady!)\\
  \exists  st?: STATE; pri?: TASK \fun  \nat  | st? = ready \land  pri? = priority \oplus  \{(running\_task \mapsto  base\_priority(running\_task))\} @ Reschedule[topReady!/target?, tasks/tasks?]\\
  queue' = queue\\
  q\_max' = q\_max\\
  q\_size' = q\_size \oplus  \{(mut? \mapsto  1)\}\\
  \Xi WaitingData\\
  \Xi QReleasingData\\
  \Xi Time\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = \{mut?\} \ndres  mutex\_holder\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  0)\}\\
  basePriorityMan\\
  \Xi MReleasingData
\end{schema}

\begin{zproof}[MutexGiveNInhS\_TQTM\$domainCheck]
invoke \Delta TaskQueueTimeMutex;
invoke predicate TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{schema}{MutexGiveNInhS\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  mut? \notin  \ran  wait\_rcv\\
  base\_priority(running\_task) \neq  priority(running\_task)\\
  \exists  topReady!: state \inv  \limg  \{ready\} \rimg  | \forall  rt: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rt) @ base\_priority(running\_task) < priority(topReady!)
\end{schema}

\begin{zproof}[MutexGiveNInhS\_TQTMFSBSig\$domainCheck]
invoke TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{theorem}{lMutexGiveNInhS\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; mut?: QUEUE; topReady!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  mut? \notin  \ran  wait\_rcv \land  base\_priority(running\_task) \neq  priority(running\_task) \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  base\_priority(running\_task) < priority(topReady!) \land  running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(mutex\_holder(mut?), phys\_context)\}, mutex\_holder := \{mut?\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(mut?, 0)\}, phys\_context := log\_context(topReady!), priority := priority \oplus  \{(mutex\_holder(mut?), base\_priority (mutex\_holder(mut?)))\}, q\_size := q\_size \oplus  \{(mut?, 1)\}, running\_task := topReady!, state := state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  rt \in  TASK \land  state(rt) = ready \land  \lnot  priority(topReady!) \geq  priority(rt))
\end{theorem}

\begin{zproof}[lMutexGiveNInhS\_TQTM\_Lemma]
with disabled (TaskData, partitionDef) prove by reduce;
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := mutex\_holder(mut?)];
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
use ranUnchanged[QUEUE, TASK][f := mutex\_holder, a := mut?];
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x == mut?;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{mutex\_holder(mut?)\};
with disabled (partitionDef) prove;
cases;
prove by reduce;
next;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topReady!\} \cup  (\{mutex\_holder(mut?)\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg )));
with normalization prove;
next;
apply extensionality to predicate \{mut?\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
instantiate x\_\_0 == mut?;
with normalization rewrite;
next;
with enabled (applyOverride) prove;
instantiate mh == idle;
instantiate x == idle;
split state(idle) = running;
prove;
next;
apply extensionality to predicate (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
instantiate x\_\_0 == x;
apply applyOverride to expression (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) x;
prove;
with normalization rewrite;
next;
apply extensionality to predicate \dom  q\_max = \{mut?\} \cup  \dom  q\_size;
apply extensionality to predicate \dom  q\_max = \dom  q\_size;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
apply inPower to predicate \dom  mutex\_recursive \in  \power  (\dom  q\_size);
instantiate e == y;
prove;
with normalization rewrite;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
with enabled (applyOverride) prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  ((state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{mut?\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(mut?, 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate rtsk == pt;
with enabled (applyOverride) prove;
next;
instantiate q\_\_0 == q;
instantiate m\_\_0 == mut?;
with enabled (applyOverride) prove;
next;
instantiate m\_\_0 == m;
instantiate y == m;
with enabled (applyOverride) prove;
next;
instantiate mh\_\_0 == mh;
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
invoke transition;
with normalization rewrite;
next;
instantiate rtsk == rt;
prove;
next;
\end{zproof}

\begin{theorem}{lMutexGiveNInhS\_TQTM\_Lemma1}
\forall  TaskQueueTimeMutex; mut?: QUEUE; topReady!: TASK | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  mut? \notin  \ran  wait\_rcv \land  base\_priority(running\_task) \neq  priority(running\_task) \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  base\_priority(running\_task) < priority(topReady!) \land  running\_task \notin  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[base\_priority := \{mutex\_holder(mut?)\} \ndres  base\_priority, log\_context := log\_context \oplus  \{(mutex\_holder(mut?), phys\_context)\}, mutex\_holder := \{mut?\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(mut?, 0)\}, phys\_context := log\_context(topReady!), priority := priority \oplus  \{(mutex\_holder(mut?), base\_priority (mutex\_holder(mut?)))\}, q\_size := q\_size \oplus  \{(mut?, 1)\}, running\_task := topReady!, state := state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  rt \in  TASK \land  state(rt) = ready \land  \lnot  priority(topReady!) \geq  priority(rt))
\end{theorem}

\begin{zproof}[lMutexGiveNInhS\_TQTM\_Lemma1]
with disabled (TaskData, partitionDef) prove by reduce;
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := mutex\_holder(mut?)];
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f)= 0 \};
instantiate x == mut?;
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{mutex\_holder(mut?)\};
with disabled (partitionDef) prove;
cases;
prove by reduce;
next;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topReady!\} \cup  (\{mutex\_holder(mut?)\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg )));
with normalization prove;
next;
apply extensionality to predicate \{mut?\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
instantiate x\_\_0 == mut?;
with normalization rewrite;
next;
with enabled (applyOverride) prove;
instantiate mh == idle;
instantiate x == idle;
split state(idle) = running;
prove;
next;
apply extensionality to predicate (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
instantiate x\_\_0 == x;
apply applyOverride to expression (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) x;
prove;
with normalization rewrite;
next;
apply extensionality to predicate \dom  q\_max = \{mut?\} \cup  \dom  q\_size;
apply extensionality to predicate \dom  q\_max = \dom  q\_size;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
apply inPower to predicate \dom  mutex\_recursive \in  \power  (\dom  q\_size);
instantiate e == y;
prove;
with normalization rewrite;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
with enabled (applyOverride) prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  ((state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  \{(topReady!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate \dom  base\_priority \setminus  (state \inv  \limg  \{running\} \rimg ) = \ran  (\{mut?\} \ndres  mutex\_holder);
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{mut?\} \ndres  mutex\_holder];
apply inRan to predicate x \in  \ran  (\{mut?\} \ndres  mutex\_holder);
apply inRan to predicate x \in  \ran  mutex\_holder;
prove;
instantiate x\_\_4 == x\_\_0;
use pairInFunction[QUEUE, TASK][f := mutex\_holder, x := mut?, y := x];
instantiate x\_\_1 == y;
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{mut?\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(mut?, 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate rtsk == pt;
with enabled (applyOverride) prove;
next;
instantiate q\_\_0 == q;
instantiate m\_\_0 == mut?;
with enabled (applyOverride) prove;
next;
instantiate m\_\_0 == m;
instantiate y == m;
with enabled (applyOverride) prove;
next;
instantiate mh\_\_0 == mh;
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
invoke transition;
with normalization rewrite;
next;
instantiate rtsk == rt;
prove;
next;
\end{zproof}

\begin{theorem}{MutexGiveNInhS\_TQTM\_vc\_ref}
\forall  MutexGiveNInhS\_TQTMFSBSig | true @ \pre  MutexGiveNInhS\_TQTM
\end{theorem}

\begin{zproof}[MutexGiveNInhS\_TQTM\_vc\_ref]
with disabled (TaskQueueTimeMutex) prove by reduce;
split running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder);
prove;
cases;
instantiate running\_task' == topReady!;
prove;
use lMutexGiveNInhS\_TQTM\_Lemma;
prove;
instantiate rt\_\_0 == rtsk;
prove;
next;
instantiate running\_task\_\_0' == topReady!;
prove;
use lMutexGiveNInhS\_TQTM\_Lemma1;
prove;
instantiate rt\_\_0 == rtsk;
prove;
next;
\end{zproof}

\begin{schema}{MutexGiveWnonInhN\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  base\_priority(running\_task) = priority(running\_task)\\
  QueueSendW\_TQT[que? := mut?]\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = \{mut?\} \ndres  mutex\_holder\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  0)\}\\
  basePriorityMan\\
  release\_mutex' = release\_mutex \oplus  \{(topReady! \mapsto  mut?)\}
\end{schema}

\begin{zproof}[MutexGiveWnonInhN\_TQTM\$domainCheck]
invoke \Delta TaskQueueTimeMutex;
invoke predicate TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{schema}{MutexGiveWnonInhN\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  QueueSendW\_TQTFSBSig[que? := mut?]\\
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  base\_priority(running\_task) = priority(running\_task)
\end{schema}

\begin{zproof}[MutexGiveWnonInhN\_TQTMFSBSig\$domainCheck]
invoke TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{theorem}{lMutexGiveWnonInhN\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topReady!: TASK; mut?: QUEUE | running\_task \notin  \dom  release\_rcv \cup  \dom  release\_snd \land  mut? \in  queue \land  q\_size(mut?) < q\_max(mut?) \land  topReady! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(running\_task) \geq  priority(topReady!) \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  base\_priority(running\_task) = priority(running\_task) \land  running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[mutex\_holder := \{mut?\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(mut?, 0)\}, q\_size := q\_size \oplus  \{(mut?, (1 + q\_size(mut?)))\}, release\_mutex := release\_mutex \oplus  \{(topReady!, mut?)\}, release\_rcv := release\_rcv \oplus  \{(topReady!, mut?)\}, release\_snd := \{mutex\_holder(mut?)\} \ndres  release\_snd, running\_task := mutex\_holder(mut?), state := state \oplus  \{(topReady!, ready)\}, time := \{topReady!\} \ndres  time, wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  priority(topReady!) \leq  priority (mutex\_holder(mut?)) \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topReady!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topReady!, ready)\}) st) \in  transition) \implies  wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = mut? \land  \lnot  priority(topReady!) \geq  priority(wr))
\end{theorem}

\begin{zproof}[lMutexGiveWnonInhN\_TQTM\_Lemma]
use lQueueSendW\_TQT\_Lemma[que? := mut?];
with disabled (TaskQueueTime, partitionDef) prove by reduce;
instantiate wrct\_\_0 == wrct;
instantiate wrct\_\_0 == wr;
instantiate ms\_\_0 == ms;
instantiate m\_\_0 == m;
use ranUnchanged[QUEUE, TASK][f := mutex\_holder, a := mut?];
with enabled (inRan) prove;
instantiate x\_\_3 == x\_\_0;
prove;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f)= 0 \};
instantiate x\_\_1 == mut?;
invoke predicate TaskQueueTime[running\_task := mutex\_holder (wait\_rcv(topReady!))];
invoke TaskQueue;
invoke Queue;
prove;
cases;
apply extensionality to predicate \{wait\_rcv(topReady!)\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
prove;
split x\_\_1 = wait\_rcv(topReady!);
prove;
next;
apply inPower to predicate \ran  (release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\}) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_0 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\};
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{topReady!\} \ndres  release\_mutex];
prove;
split e = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{wait\_rcv(topReady!)\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topReady!), 1)\}) f\_\_1 = 0 \};
invoke QueueData;
with enabled (applyOverride) prove;
next;
apply inPower to predicate release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\} \in  \power  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
with enabled (oplusDef) prove;
instantiate e\_\_0 == e;
prove;
next;
with enabled (applyOverride) prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{lMutexGiveWnonInhN\_TQTM\_Lemma1}
\forall  TaskQueueTimeMutex; topReady!: TASK; mut?: QUEUE | running\_task \notin  \dom  release\_rcv \cup  \dom  release\_snd \land  mut? \in  queue \land  q\_size(mut?) < q\_max(mut?) \land  topReady! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(running\_task) \geq  priority(topReady!) \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  base\_priority(running\_task) = priority(running\_task) \land  running\_task \notin  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[base\_priority := \{mutex\_holder(mut?)\} \ndres  base\_priority, mutex\_holder := \{mut?\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(mut?, 0)\}, q\_size := q\_size \oplus  \{(mut?, (1 + q\_size(mut?)))\}, release\_mutex := release\_mutex \oplus  \{(topReady!, mut?)\}, release\_rcv := release\_rcv \oplus  \{(topReady!, mut?)\}, release\_snd := \{mutex\_holder(mut?)\} \ndres  release\_snd, running\_task := mutex\_holder(mut?), state := state \oplus  \{(topReady!, ready)\}, time := \{topReady!\} \ndres  time, wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  priority(topReady!) \leq  priority (mutex\_holder(mut?)) \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topReady!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topReady!, ready)\}) st) \in  transition) \implies  wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = mut? \land  \lnot  priority(topReady!) \geq  priority(wr))
\end{theorem}

\begin{zproof}[lMutexGiveWnonInhN\_TQTM\_Lemma1]
use lQueueSendW\_TQT\_Lemma[que? := mut?];
with disabled (TaskQueueTime, partitionDef) prove by reduce;
instantiate wrct\_\_0 == wrct;
instantiate wrct\_\_0 == wr;
instantiate ms\_\_0 == ms;
instantiate m\_\_0 == m;
apply inRan to predicate ms \in  \ran  (\{mutex\_holder (wait\_rcv(topReady!))\} \ndres  release\_snd);
apply inRan to predicate ms \in  \ran  release\_snd;
with disabled (partitionDef) prove;
instantiate x\_\_0 == x;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x\_\_0 == mut?;
invoke predicate TaskQueueTime[running\_task := mutex\_holder (wait\_rcv(topReady!))];
invoke TaskQueue;
invoke Queue;
prove;
cases;
apply extensionality to predicate \{wait\_rcv(topReady!)\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
prove;
split x\_\_0 = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate \dom  base\_priority \setminus  \{mutex\_holder (wait\_rcv(topReady!))\} = \ran  (\{wait\_rcv(topReady!)\} \ndres  mutex\_holder);
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
prove;
instantiate x\_\_1 == x\_\_0;
instantiate y\_\_0 == y;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{wait\_rcv(topReady!)\} \ndres  mutex\_holder];
apply inRan to predicate x \in  \ran  (\{wait\_rcv(topReady!)\} \ndres  mutex\_holder);
apply inRan to predicate x \in  \ran  mutex\_holder;
prove;
instantiate x\_\_5 == x\_\_1;
use pairInFunction[QUEUE, TASK][f := mutex\_holder, x := wait\_rcv(topReady!), y := x];
prove;
cases;
prove;
next;
prove;
next;
apply inPower to predicate \ran  (release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\}) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_0 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\};
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{topReady!\} \ndres  release\_mutex];
prove;
split e = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{wait\_rcv(topReady!)\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topReady!), 1)\}) f\_\_1 = 0 \};
invoke QueueData;
with enabled (applyOverride) prove;
next;
apply inPower to predicate release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\} \in  \power  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
with enabled (oplusDef) prove;
instantiate e\_\_0 == e;
prove;
next;
with enabled (applyOverride) prove;
next;
instantiate mh\_\_0 == mh;
prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{MutexGiveWnonInhN\_TQTM\_vc\_ref}
\forall  MutexGiveWnonInhN\_TQTMFSBSig | true @ \pre  MutexGiveWnonInhN\_TQTM
\end{theorem}

\begin{zproof}[MutexGiveWnonInhN\_TQTM\_vc\_ref]
use findDelegate[a := wait\_rcv \inv  \limg  \{mut?\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
split running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder);
prove;
cases;
instantiate topReady! == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
prove;
use lMutexGiveWnonInhN\_TQTM\_Lemma[topReady! := f (wait\_rcv \inv  \limg  \{mut?\} \rimg )];
prove;
instantiate wr\_\_0 == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
instantiate t == wrct;
with normalization rewrite;
next;
instantiate topReady\_\_0! == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
prove;
use lMutexGiveWnonInhN\_TQTM\_Lemma1[topReady! := f (wait\_rcv \inv  \limg  \{mut?\} \rimg )];
prove;
instantiate wr\_\_0 == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
instantiate t == wrct;
with normalization rewrite;
next;
\end{zproof}

\begin{schema}{MutexGiveWnonInhS\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  base\_priority(running\_task) = priority(running\_task)\\
  QueueSendWS\_TQT[que? := mut?]\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = \{mut?\} \ndres  mutex\_holder\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  0)\}\\
  basePriorityMan\\
  release\_mutex' = release\_mutex \oplus  \{(topReady! \mapsto  mut?)\}
\end{schema}

\begin{zproof}[MutexGiveWnonInhS\_TQTM\$domainCheck]
invoke \Delta TaskQueueTimeMutex;
invoke predicate TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{schema}{MutexGiveWnonInhS\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE\\
\where
  QueueSendWS\_TQTFSBSig[que? := mut?]\\
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  base\_priority(running\_task) = priority(running\_task)
\end{schema}

\begin{zproof}[MutexGiveWnonInhS\_TQTMFSBSig\$domainCheck]
invoke TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{theorem}{lMutexGiveWnonInhS\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topReady!: TASK; mut?: QUEUE | running\_task \notin  \dom  release\_rcv \land  (running\_task \in  \dom  release\_snd \implies  mut? = release\_snd(running\_task)) \land  mut? \in  queue \land  q\_size(mut?) < q\_max(mut?) \land  topReady! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(topReady!) > priority(running\_task) \land  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  base\_priority(running\_task) = priority(running\_task) \land  running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(mutex\_holder (wait\_rcv(topReady!)), phys\_context)\}, mutex\_holder := \{wait\_rcv(topReady!)\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(wait\_rcv(topReady!), 0)\}, phys\_context := log\_context(topReady!), q\_size := q\_size \oplus  \{(wait\_rcv(topReady!), (1 + q\_size (wait\_rcv(topReady!))))\}, release\_mutex := release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\}, release\_rcv := release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\}, release\_snd := \{mutex\_holder (wait\_rcv(topReady!))\} \ndres  release\_snd, running\_task := topReady!, state := state \oplus  (\{(mutex\_holder (wait\_rcv(topReady!)), ready)\} \cup  \{(topReady!, running)\}), time := \{topReady!\} \ndres  time, wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(mutex\_holder (wait\_rcv(topReady!)), ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(mutex\_holder (wait\_rcv(topReady!)), ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = wait\_rcv(topReady!) \land  \lnot  priority(topReady!) \geq  priority(wr))
\end{theorem}

\begin{zproof}[lMutexGiveWnonInhS\_TQTM\_Lemma]
use lQueueSendWS\_TQT\_Lemma[que? := mut?];
with disabled (TaskQueueTime) prove by reduce;
instantiate wrct\_\_0 == wrct;
instantiate wrct\_\_0 == wr;
instantiate ms\_\_0 == ms;
instantiate m\_\_0 == m;
apply inRan to predicate ms \in  \ran  (\{mutex\_holder (wait\_rcv(topReady!))\} \ndres  release\_snd);
apply inRan to predicate ms \in  \ran  release\_snd;
prove;
instantiate x\_\_0 == x;
use ranUnchanged[QUEUE, TASK][f := mutex\_holder, a := mut?];
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x\_\_0 == mut?;
invoke predicate TaskQueueTime[running\_task := mutex\_holder (wait\_rcv(topReady!))];
invoke TaskQueue;
invoke Queue;
prove;
cases;
apply extensionality to predicate \{wait\_rcv(topReady!)\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
prove;
split x\_\_0 = wait\_rcv(topReady!);
prove;
next;
apply inPower to predicate \ran  (release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\}) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_0 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\};
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{topReady!\} \ndres  release\_mutex];
prove;
split e = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{wait\_rcv(topReady!)\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topReady!), 1)\}) f\_\_1 = 0 \};
invoke QueueData;
with enabled (applyOverride) prove;
next;
apply inPower to predicate release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\} \in  \power  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
with enabled (oplusDef) prove;
instantiate e\_\_0 == e;
prove;
next;
with enabled (applyOverride) prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{lMutexGiveWnonInhS\_TQTM\_Lemma1}
\forall  TaskQueueTimeMutex; topReady!: TASK; mut?: QUEUE | running\_task \notin  \dom  release\_rcv \land  (running\_task \in  \dom  release\_snd \implies  mut? = release\_snd(running\_task)) \land  mut? \in  queue \land  q\_size(mut?) < q\_max(mut?) \land  topReady! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(topReady!) > priority(running\_task) \land  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  base\_priority(running\_task) = priority(running\_task) \land  running\_task \notin  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[base\_priority := \{mutex\_holder (wait\_rcv(topReady!))\} \ndres  base\_priority, log\_context := log\_context \oplus  \{(mutex\_holder (wait\_rcv(topReady!)), phys\_context)\}, mutex\_holder := \{wait\_rcv(topReady!)\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(wait\_rcv(topReady!), 0)\}, phys\_context := log\_context(topReady!), q\_size := q\_size \oplus  \{(wait\_rcv(topReady!), (1 + q\_size (wait\_rcv(topReady!))))\}, release\_mutex := release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\}, release\_rcv := release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\}, release\_snd := \{mutex\_holder (wait\_rcv(topReady!))\} \ndres  release\_snd, running\_task := topReady!, state := state \oplus  (\{(mutex\_holder (wait\_rcv(topReady!)), ready)\} \cup  \{(topReady!, running)\}), time := \{topReady!\} \ndres  time, wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(mutex\_holder (wait\_rcv(topReady!)), ready)\} \cup  \{(topReady!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(mutex\_holder (wait\_rcv(topReady!)), ready)\} \cup  \{(topReady!, running)\})) st) \in  transition) \implies  wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = wait\_rcv(topReady!) \land  \lnot  priority(topReady!) \geq  priority(wr))
\end{theorem}

\begin{zproof}[lMutexGiveWnonInhS\_TQTM\_Lemma1]
use lQueueSendWS\_TQT\_Lemma[que? := mut?];
with disabled (TaskQueueTime) prove by reduce;
instantiate wrct\_\_0 == wrct;
instantiate wrct\_\_0 == wr;
instantiate ms\_\_0 == ms;
instantiate m\_\_0 == m;
instantiate mh\_\_0 == mh;
apply inRan to predicate ms \in  \ran  (\{mutex\_holder (wait\_rcv(topReady!))\} \ndres  release\_snd);
apply inRan to predicate ms \in  \ran  release\_snd;
prove;
instantiate x\_\_0 == x;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x\_\_0 == mut?;
invoke predicate TaskQueueTime[running\_task := mutex\_holder (wait\_rcv(topReady!))];
invoke TaskQueue;
invoke Queue;
prove;
cases;
apply extensionality to predicate \{wait\_rcv(topReady!)\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
prove;
split x\_\_0 = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate \dom  base\_priority \setminus  \{mutex\_holder (wait\_rcv(topReady!))\} = \ran  (\{wait\_rcv(topReady!)\} \ndres  mutex\_holder);
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
prove;
instantiate x\_\_1 == x\_\_0;
instantiate y\_\_0 == y;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{wait\_rcv(topReady!)\} \ndres  mutex\_holder];
apply inRan to predicate x \in  \ran  (\{wait\_rcv(topReady!)\} \ndres  mutex\_holder);
apply inRan to predicate x \in  \ran  mutex\_holder;
prove;
instantiate x\_\_5 == x\_\_1;
use pairInFunction[QUEUE, TASK][f := mutex\_holder, x := wait\_rcv(topReady!), y := x];
prove;
cases;
prove;
next;
prove;
next;
apply inPower to predicate \ran  (release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\}) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_0 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\};
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{topReady!\} \ndres  release\_mutex];
prove;
split e = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{wait\_rcv(topReady!)\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topReady!), 1)\}) f\_\_1 = 0 \};
invoke QueueData;
with enabled (applyOverride) prove;
next;
apply inPower to predicate release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\} \in  \power  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
with enabled (oplusDef) prove;
instantiate e\_\_0 == e;
prove;
next;
with enabled (applyOverride) prove;
next;
prove;
next;
prove;
next;
\end{zproof}

\begin{theorem}{MutexGiveWnonInhS\_TQTM\_vc\_ref}
\forall  MutexGiveWnonInhS\_TQTMFSBSig | true @ \pre  MutexGiveWnonInhS\_TQTM
\end{theorem}

\begin{zproof}[MutexGiveWnonInhS\_TQTM\_vc\_ref]
with disabled (TaskQueueTimeMutex) prove by reduce;
split running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder);
prove;
cases;
instantiate running\_task' == topReady!;
prove;
use lMutexGiveWnonInhS\_TQTM\_Lemma;
prove;
instantiate wr\_\_0 == wrct;
prove;
next;
instantiate running\_task\_\_0' == topReady!;
prove;
use lMutexGiveWnonInhS\_TQTM\_Lemma1;
prove;
instantiate wr\_\_0 == wrct;
prove;
next;
\end{zproof}

\begin{schema}{MutexGiveWInhN\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  topReady! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg \\
  \forall  wr: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topReady!) \geq  priority(wr)\\
  priority(topReady!) \leq  base\_priority(running\_task)\\
  base\_priority(running\_task) \neq  priority(running\_task)\\
  \forall  rt: state \inv  \limg  \{ready\} \rimg  @ base\_priority(running\_task) \geq  priority(rt)\\
  \Xi TaskData\\
  state' = state \oplus  \{(topReady! \mapsto  ready)\}\\
  \Xi ContextData\\
  priority' = priority \oplus  \{(running\_task \mapsto  base\_priority(running\_task))\}\\
  queue' = queue\\
  q\_max' = q\_max\\
  q\_size' = q\_size \oplus  \{(mut? \mapsto  1)\}\\
  wait\_snd' = wait\_snd\\
  wait\_rcv' = \{topReady!\} \ndres  wait\_rcv\\
  release\_snd' = release\_snd\\
  release\_rcv' = release\_rcv \oplus  \{(topReady! \mapsto  mut?)\}\\
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = \{topReady!\} \ndres  time\\
  time\_slice' = time\_slice\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = \{mut?\} \ndres  mutex\_holder\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  0)\}\\
  basePriorityMan\\
  release\_mutex' = release\_mutex \oplus  \{(topReady! \mapsto  mut?)\}
\end{schema}

\begin{zproof}[MutexGiveWInhN\_TQTM\$domainCheck]
invoke \Delta TaskQueueTimeMutex;
invoke predicate TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{schema}{MutexGiveWInhN\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  \forall  wr: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ base\_priority(running\_task) \geq  priority(wr)\\
  base\_priority(running\_task) \neq  priority(running\_task)\\
  \forall  rt: state \inv  \limg  \{ready\} \rimg  @ base\_priority(running\_task) \geq  priority(rt)
\end{schema}

\begin{zproof}[MutexGiveWInhN\_TQTMFSBSig\$domainCheck]
invoke TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{theorem}{lMutexGiveWInhN\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topReady!: TASK; mut?: QUEUE | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  topReady! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(topReady!) \leq  base\_priority(running\_task) \land  base\_priority(running\_task) \neq  priority(running\_task) \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ base\_priority(running\_task) \geq  priority(rtsk)) \land  running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[mutex\_holder := \{mut?\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(mut?, 0)\}, priority := priority \oplus  \{(mutex\_holder(mut?), base\_priority (mutex\_holder(mut?)))\}, q\_size := q\_size \oplus  \{(mut?, 1)\}, release\_mutex := release\_mutex \oplus  \{(topReady!, mut?)\}, release\_rcv := release\_rcv \oplus  \{(topReady!, mut?)\}, running\_task := mutex\_holder(mut?), state := state \oplus  \{(topReady!, ready)\}, time := \{topReady!\} \ndres  time, wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  priority(topReady!) \leq  base\_priority (mutex\_holder(mut?)) \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topReady!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topReady!, ready)\}) st) \in  transition) \implies  wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = mut? \land  \lnot  priority(topReady!) \geq  priority(wr))
\end{theorem}

\begin{zproof}[lMutexGiveWInhN\_TQTM\_Lemma]
with enabled (disjointCat) prove by reduce;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x == mut?;
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == topReady!;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := wait\_rcv(topReady!)];
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := mutex\_holder (wait\_rcv(topReady!))];
use applyInRanFun[TASK, \nat ][f := priority, a := running\_task];
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{mutex\_holder (wait\_rcv(topReady!))\};
prove;
use applyInRanPfun[TASK, QUEUE][A := TASK, B := QUEUE, f := wait\_rcv, a := topReady!];
apply inPower to predicate \ran  wait\_rcv \in  \power  (\dom  q\_size);
instantiate e == wait\_rcv(topReady!);
prove;
cases;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  \{(topReady!, ready)\}) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == topReady!;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topReady!\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ));
prove;
with normalization rewrite;
next;
apply extensionality to predicate \{wait\_rcv(topReady!)\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
prove;
split x = wait\_rcv(topReady!);
prove;
next;
with enabled (applyOverride) prove;
instantiate mh == running\_task;
split priority (mutex\_holder (wait\_rcv(topReady!))) = 0;
prove;
next;
apply extensionality to predicate \dom  q\_max = \{wait\_rcv(topReady!)\} \cup  \dom  q\_size;
apply extensionality to predicate \dom  q\_max = \dom  q\_size;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
prove;
split y = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate \dom  wait\_snd \cap  (\dom  wait\_rcv \setminus  \{topReady!\}) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate \dom  release\_snd \cap  (\{topReady!\} \cup  \dom  release\_rcv) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
prove;
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
instantiate x\_\_2 == x;
prove;
next;
apply inPower to predicate \ran  (\{topReady!\} \ndres  wait\_rcv) \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := wait\_rcv, R := \{topReady!\} \ndres  wait\_rcv];
prove;
next;
apply inPower to predicate \ran  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\}) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  release\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_1 == e;
apply oplusDef to expression release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\};
use ranSubset[TASK, QUEUE][S := release\_rcv, R := \{topReady!\} \ndres  release\_rcv];
prove;
split e = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate (\{topReady!\} \cup  (\dom  release\_rcv \cup  \dom  release\_snd)) \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topReady!\})) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
prove;
split x = topReady!;
prove;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  \{(topReady!, ready)\}) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_1 == e;
with enabled (applyOverride) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == topReady!;
prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  (\{topReady!\} \cup  ((state \oplus  \{(topReady!, ready)\}) \inv  \limg  \{blocked\} \rimg ));
prove;
instantiate e\_\_1 == e;
prove;
next;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topReady!\})) = \{\};
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topReady!\})) = delayed\_task \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd) \setminus  \{topReady!\};
prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == topReady!;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == topReady!;
prove;
next;
use ranUnchanged[QUEUE, TASK][f := mutex\_holder, a := mut?];
prove;
next;
apply inPower to predicate \ran  (release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\}) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_2 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\};
prove;
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{topReady!\} \ndres  release\_mutex];
split e = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{wait\_rcv(topReady!)\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topReady!), 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
next;
apply inPower to predicate release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\} \in  \power  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\};
apply oplusDef to expression release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\};
prove;
next;
with enabled (applyOverride) prove;
next;
instantiate rtsk == pt;
prove;
split pt \in  TASK;
with enabled (applyOverride) prove;
split pt = topReady!;
prove;
next;
instantiate q\_\_0 == q;
instantiate m\_\_0 == wait\_rcv(topReady!);
with enabled (applyOverride) prove;
next;
instantiate t\_\_0 == t;
apply applyNdres to expression (\{topReady!\} \ndres  time) t;
prove;
next;
instantiate m\_\_0 == m;
with enabled (applyOverride) prove;
instantiate y == m;
prove;
next;
instantiate mh\_\_0 == mh;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{wait\_rcv(topReady!)\} \ndres  mutex\_holder];
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
invoke transition;
prove;
next;
instantiate wrct == wr;
prove;
next;
\end{zproof}

\begin{theorem}{lMutexGiveWInhN\_TQTM\_Lemma1}
\forall  TaskQueueTimeMutex; topReady!: TASK; mut?: QUEUE | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  topReady! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topReady!) \geq  priority(wrct)) \land  priority(topReady!) \leq  base\_priority(running\_task) \land  base\_priority(running\_task) \neq  priority(running\_task) \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ base\_priority(running\_task) \geq  priority(rtsk)) \land  running\_task \notin  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[base\_priority := \{mutex\_holder(mut?)\} \ndres  base\_priority, mutex\_holder := \{mut?\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(mut?, 0)\}, priority := priority \oplus  \{(mutex\_holder(mut?), base\_priority (mutex\_holder(mut?)))\}, q\_size := q\_size \oplus  \{(mut?, 1)\}, release\_mutex := release\_mutex \oplus  \{(topReady!, mut?)\}, release\_rcv := release\_rcv \oplus  \{(topReady!, mut?)\}, running\_task := mutex\_holder(mut?), state := state \oplus  \{(topReady!, ready)\}, time := \{topReady!\} \ndres  time, wait\_rcv := \{topReady!\} \ndres  wait\_rcv] \land  priority(topReady!) \leq  base\_priority (mutex\_holder(mut?)) \land  (st \in  TASK \land  \lnot  (state \oplus  \{(topReady!, ready)\}) st = state(st) \implies  (state(st), (state \oplus  \{(topReady!, ready)\}) st) \in  transition) \implies  wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = mut? \land  \lnot  priority(topReady!) \geq  priority(wr))
\end{theorem}

\begin{zproof}[lMutexGiveWInhN\_TQTM\_Lemma1]
with enabled (disjointCat) prove by reduce;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x == mut?;
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == topReady!;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := wait\_rcv(topReady!)];
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := mutex\_holder (wait\_rcv(topReady!))];
use applyInRanFun[TASK, \nat ][f := priority, a := running\_task];
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{mutex\_holder (wait\_rcv(topReady!))\};
prove;
use applyInRanPfun[TASK, QUEUE][A := TASK, B := QUEUE, f := wait\_rcv, a := topReady!];
apply inPower to predicate \ran  wait\_rcv \in  \power  (\dom  q\_size);
instantiate e == wait\_rcv(topReady!);
prove;
cases;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  \{(topReady!, ready)\}) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == topReady!;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topReady!\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ));
prove;
with normalization rewrite;
next;
apply extensionality to predicate \{wait\_rcv(topReady!)\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
prove;
split x = wait\_rcv(topReady!);
prove;
next;
with enabled (applyOverride) prove;
instantiate mh == running\_task;
split priority (mutex\_holder (wait\_rcv(topReady!))) = 0;
prove;
next;
apply extensionality to predicate \dom  q\_max = \{wait\_rcv(topReady!)\} \cup  \dom  q\_size;
apply extensionality to predicate \dom  q\_max = \dom  q\_size;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
prove;
split y = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate \dom  wait\_snd \cap  (\dom  wait\_rcv \setminus  \{topReady!\}) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate \dom  release\_snd \cap  (\{topReady!\} \cup  \dom  release\_rcv) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
prove;
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
instantiate x\_\_2 == x;
prove;
next;
apply inPower to predicate \ran  (\{topReady!\} \ndres  wait\_rcv) \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := wait\_rcv, R := \{topReady!\} \ndres  wait\_rcv];
prove;
next;
apply inPower to predicate \ran  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\}) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  release\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_1 == e;
apply oplusDef to expression release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\};
use ranSubset[TASK, QUEUE][S := release\_rcv, R := \{topReady!\} \ndres  release\_rcv];
prove;
split e = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate (\{topReady!\} \cup  (\dom  release\_rcv \cup  \dom  release\_snd)) \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topReady!\})) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
prove;
split x = topReady!;
prove;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  \{(topReady!, ready)\}) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_1 == e;
with enabled (applyOverride) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == topReady!;
prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  (\{topReady!\} \cup  ((state \oplus  \{(topReady!, ready)\}) \inv  \limg  \{blocked\} \rimg ));
prove;
instantiate e\_\_1 == e;
prove;
next;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topReady!\})) = \{\};
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topReady!\})) = delayed\_task \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd) \setminus  \{topReady!\};
prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == topReady!;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == topReady!;
prove;
next;
apply extensionality to predicate \dom  base\_priority \setminus  (state \inv  \limg  \{running\} \rimg ) = \ran  (\{wait\_rcv(topReady!)\} \ndres  mutex\_holder);
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{wait\_rcv(topReady!)\} \ndres  mutex\_holder];
apply inRan to predicate x \in  \ran  (\{wait\_rcv(topReady!)\} \ndres  mutex\_holder);
apply inRan to predicate x \in  \ran  mutex\_holder;
prove;
instantiate x\_\_4 == x\_\_0;
use pairInFunction[QUEUE, TASK][f := mutex\_holder, x := wait\_rcv(topReady!), y := x];
prove;
cases;
prove;
next;
instantiate x\_\_1 == y;
prove;
next;
apply inPower to predicate \ran  (release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\}) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_2 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\};
prove;
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{topReady!\} \ndres  release\_mutex];
split e = wait\_rcv(topReady!);
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{wait\_rcv(topReady!)\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topReady!), 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
next;
apply inPower to predicate release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\} \in  \power  (release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topReady!, wait\_rcv(topReady!))\};
apply oplusDef to expression release\_rcv \oplus  \{(topReady!, wait\_rcv(topReady!))\};
prove;
next;
with enabled (applyOverride) prove;
next;
instantiate rtsk == pt;
prove;
split pt \in  TASK;
with enabled (applyOverride) prove;
split pt = topReady!;
prove;
next;
instantiate q\_\_0 == q;
instantiate m\_\_0 == wait\_rcv(topReady!);
with enabled (applyOverride) prove;
next;
instantiate t\_\_0 == t;
apply applyNdres to expression (\{topReady!\} \ndres  time) t;
prove;
next;
instantiate m\_\_0 == m;
with enabled (applyOverride) prove;
instantiate y == m;
prove;
next;
instantiate mh\_\_0 == mh;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{wait\_rcv(topReady!)\} \ndres  mutex\_holder];
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
invoke transition;
prove;
next;
instantiate wrct == wr;
prove;
next;
\end{zproof}

\begin{theorem}{MutexGiveWInhN\_TQTM\_vc\_ref}
\forall  MutexGiveWInhN\_TQTMFSBSig | true @ \pre  MutexGiveWInhN\_TQTM
\end{theorem}

\begin{zproof}[MutexGiveWInhN\_TQTM\_vc\_ref]
use findDelegate[a := wait\_rcv \inv  \limg  \{mut?\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
split running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder);
prove;
cases;
instantiate topReady! == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
prove;
use lMutexGiveWInhN\_TQTM\_Lemma[topReady! := f (wait\_rcv \inv  \limg  \{mut?\} \rimg )];
prove;
instantiate wr\_\_0 == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
instantiate t == wrct;
instantiate rt == rtsk;
with normalization rewrite;
next;
instantiate topReady\_\_0! == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
prove;
use lMutexGiveWInhN\_TQTM\_Lemma1[topReady! := f (wait\_rcv \inv  \limg  \{mut?\} \rimg )];
prove;
instantiate wr\_\_0 == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
instantiate t == wrct;
instantiate rt == rtsk;
with normalization rewrite;
next;
\end{zproof}

\begin{schema}{MutexGiveWInhSR\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topWaiting!: TASK\\
  topReady!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  topWaiting! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg \\
  \forall  wr: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topWaiting!) \geq  priority(wr)\\
  state(topReady!) = ready\\
  \forall  rt: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rt)\\
  base\_priority(running\_task) \neq  priority(running\_task)\\
  priority(topReady!) > priority(topWaiting!)\\
  priority(topReady!) > base\_priority(running\_task)\\
  tasks' = tasks\\
  running\_task' = topReady!\\
  state' = state \oplus  \{(running\_task \mapsto  ready), (topReady! \mapsto  running), (topWaiting! \mapsto  ready)\}\\
  phys\_context' = log\_context(topReady!)\\
  log\_context' = log\_context \oplus  \{(running\_task \mapsto  phys\_context)\}\\
  priority' = priority \oplus  \{(running\_task \mapsto  base\_priority(running\_task))\}\\
  queue' = queue\\
  q\_max' = q\_max\\
  q\_size' = q\_size \oplus  \{(mut? \mapsto  1)\}\\
  wait\_snd' = wait\_snd\\
  wait\_rcv' = \{topWaiting!\} \ndres  wait\_rcv\\
  release\_snd' = release\_snd\\
  release\_rcv' = release\_rcv \oplus  \{(topWaiting! \mapsto  mut?)\}\\
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = \{topWaiting!\} \ndres  time\\
  time\_slice' = time\_slice\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = \{mut?\} \ndres  mutex\_holder\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  0)\}\\
  basePriorityMan\\
  release\_mutex' = release\_mutex \oplus  \{(topWaiting! \mapsto  mut?)\}
\end{schema}

\begin{zproof}[MutexGiveWInhSR\_TQTM\$domainCheck]
invoke \Delta TaskQueueTimeMutex;
invoke predicate TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{schema}{MutexGiveWInhSR\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  base\_priority(running\_task) \neq  priority(running\_task)\\
  \exists  topReady!: state \inv  \limg  \{ready\} \rimg  @ (\forall  rt: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rt)) \land  (\forall  wr: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topReady!) > priority(wr)) \land  priority(topReady!) > base\_priority(running\_task)
\end{schema}

\begin{zproof}[MutexGiveWInhSR\_TQTMFSBSig\$domainCheck]
invoke TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{theorem}{lMutexGiveWInhSR\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topReady!, topWaiting!: TASK; mut?: QUEUE | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  topWaiting! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topWaiting!) \geq  priority(wrct)) \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  base\_priority(running\_task) \neq  priority(running\_task) \land  priority(topReady!) > priority(topWaiting!) \land  priority(topReady!) > base\_priority(running\_task) \land  running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(mutex\_holder(mut?), phys\_context)\}, mutex\_holder := \{mut?\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(mut?, 0)\}, phys\_context := log\_context(topReady!), priority := priority \oplus  \{(mutex\_holder(mut?), base\_priority (mutex\_holder(mut?)))\}, q\_size := q\_size \oplus  \{(mut?, 1)\}, release\_mutex := release\_mutex \oplus  \{(topWaiting!, mut?)\}, release\_rcv := release\_rcv \oplus  \{(topWaiting!, mut?)\}, running\_task := topReady!, state := state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  (\{(topReady!, running)\} \cup  \{(topWaiting!, ready)\})), time := \{topWaiting!\} \ndres  time, wait\_rcv := \{topWaiting!\} \ndres  wait\_rcv] \land  priority(topReady!) > priority(topWaiting!) \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  (\{(topReady!, running)\} \cup  \{(topWaiting!, ready)\}))) st = state(st) \implies  (state(st), (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  (\{(topReady!, running)\} \cup  \{(topWaiting!, ready)\}))) st) \in  transition) \land  (wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = mut? \implies  priority(topWaiting!) \geq  priority(wr)) \implies  rt \in  TASK \land  state(rt) = ready \land  \lnot  priority(topReady!) \geq  priority(rt))
\end{theorem}

\begin{zproof}[lMutexGiveWInhSR\_TQTM\_Lemma]
with disabled (TaskData) with enabled (disjointCat) prove by reduce;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x == mut?;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := wait\_rcv(topWaiting!)];
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := mutex\_holder (wait\_rcv(topWaiting!))];
use applyInRanFun[TASK, \nat ][f := priority, a := running\_task];
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{mutex\_holder (wait\_rcv(topWaiting!))\};
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{nonexistent\} \rimg );
invoke predicate TaskData[running\_task := topReady!, tasks := TASK \setminus  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{nonexistent\} \rimg )];
with disabled (setminUpdate) prove;
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == topWaiting!;
use applyInRanPfun[TASK, QUEUE][A := TASK, B := QUEUE, f := wait\_rcv, a := topWaiting!];
apply inPower to predicate \ran  wait\_rcv \in  \power  (\dom  q\_size);
instantiate e == wait\_rcv(topWaiting!);
prove;
cases;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == e;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{nonexistent\} \rimg );
with enabled (distributeDiffOverCupRight) prove;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
apply extensionality to predicate \{wait\_rcv(topWaiting!)\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
prove;
split x = wait\_rcv(topWaiting!);
prove;
next;
with enabled (applyOverride) prove;
instantiate mh == running\_task;
split priority (mutex\_holder (wait\_rcv(topWaiting!))) = 0;
prove;
next;
apply extensionality to predicate (state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
instantiate x\_\_0 == x;
apply applyOverride to expression (state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) x;
prove;
with normalization rewrite;
next;
apply extensionality to predicate \dom  q\_max = \{wait\_rcv(topWaiting!)\} \cup  \dom  q\_size;
apply extensionality to predicate \dom  q\_max = \dom  q\_size;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
prove;
split y = wait\_rcv(topWaiting!);
prove;
next;
apply extensionality to predicate \dom  wait\_snd \cap  (\dom  wait\_rcv \setminus  \{topWaiting!\}) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate \dom  release\_snd \cap  (\{topWaiting!\} \cup  \dom  release\_rcv) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
prove;
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
instantiate x\_\_2 == x;
prove;
next;
apply inPower to predicate \ran  (\{topWaiting!\} \ndres  wait\_rcv) \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := wait\_rcv, R := \{topWaiting!\} \ndres  wait\_rcv];
prove;
next;
apply inPower to predicate \ran  (release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  release\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_1 == e;
apply oplusDef to expression release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\};
use ranSubset[TASK, QUEUE][S := release\_rcv, R := \{topWaiting!\} \ndres  release\_rcv];
prove;
with normalization rewrite;
next;
apply extensionality to predicate (\{topWaiting!\} \cup  (\dom  release\_rcv \cup  \dom  release\_snd)) \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topWaiting!\})) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_0 == x;
with normalization rewrite;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_1 == e;
with enabled (applyOverride) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == topWaiting!;
prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  (\{topWaiting!\} \cup  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{blocked\} \rimg ));
prove;
instantiate e\_\_1 == e;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topWaiting!\})) = \{\};
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topWaiting!\})) = delayed\_task \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd) \setminus  \{topWaiting!\};
prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
with normalization rewrite;
next;
use ranUnchanged[QUEUE, TASK][f := mutex\_holder, a := mut?];
prove;
next;
apply inPower to predicate \ran  (release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_2 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\};
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{topWaiting!\} \ndres  release\_mutex];
split e = wait\_rcv(topWaiting!);
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{wait\_rcv(topWaiting!)\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topWaiting!), 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
next;
apply inPower to predicate release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\} \in  \power  (release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
with enabled (oplusDef) prove;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate rtsk == pt;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate q\_\_0 == q;
instantiate m\_\_0 == wait\_rcv(topWaiting!);
with enabled (applyOverride) prove;
next;
instantiate t\_\_0 == t;
apply applyNdres to expression (\{topWaiting!\} \ndres  time) t;
prove;
next;
instantiate m\_\_0 == m;
with enabled (applyOverride) prove;
instantiate y == m;
prove;
next;
instantiate mh\_\_0 == mh;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder];
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
invoke transition;
with normalization rewrite;
next;
instantiate wrct == wr;
prove;
next;
instantiate rtsk == rt;
prove;
next;
\end{zproof}

\begin{theorem}{lMutexGiveWInhSR\_TQTM\_Lemma1}
\forall  TaskQueueTimeMutex; topReady!, topWaiting!: TASK; mut?: QUEUE | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  topWaiting! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topWaiting!) \geq  priority(wrct)) \land  state(topReady!) = ready \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topReady!) \geq  priority(rtsk)) \land  base\_priority(running\_task) \neq  priority(running\_task) \land  priority(topReady!) > priority(topWaiting!) \land  priority(topReady!) > base\_priority(running\_task) \land  running\_task \notin  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[base\_priority := \{mutex\_holder(mut?)\} \ndres  base\_priority, log\_context := log\_context \oplus  \{(mutex\_holder(mut?), phys\_context)\}, mutex\_holder := \{mut?\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(mut?, 0)\}, phys\_context := log\_context(topReady!), priority := priority \oplus  \{(mutex\_holder(mut?), base\_priority (mutex\_holder(mut?)))\}, q\_size := q\_size \oplus  \{(mut?, 1)\}, release\_mutex := release\_mutex \oplus  \{(topWaiting!, mut?)\}, release\_rcv := release\_rcv \oplus  \{(topWaiting!, mut?)\}, running\_task := topReady!, state := state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  (\{(topReady!, running)\} \cup  \{(topWaiting!, ready)\})), time := \{topWaiting!\} \ndres  time, wait\_rcv := \{topWaiting!\} \ndres  wait\_rcv] \land  priority(topReady!) > priority(topWaiting!) \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  (\{(topReady!, running)\} \cup  \{(topWaiting!, ready)\}))) st = state(st) \implies  (state(st), (state \oplus  (\{(mutex\_holder(mut?), ready)\} \cup  (\{(topReady!, running)\} \cup  \{(topWaiting!, ready)\}))) st) \in  transition) \land  (wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = mut? \implies  priority(topWaiting!) \geq  priority(wr)) \implies  rt \in  TASK \land  state(rt) = ready \land  \lnot  priority(topReady!) \geq  priority(rt))
\end{theorem}

\begin{zproof}[lMutexGiveWInhSR\_TQTM\_Lemma1]
with disabled (TaskData) with enabled (disjointCat) prove by reduce;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x == mut?;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := wait\_rcv(topWaiting!)];
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := mutex\_holder (wait\_rcv(topWaiting!))];
use applyInRanFun[TASK, \nat ][f := priority, a := running\_task];
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{mutex\_holder (wait\_rcv(topWaiting!))\};
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{nonexistent\} \rimg );
invoke predicate TaskData[running\_task := topReady!, tasks := TASK \setminus  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{nonexistent\} \rimg )];
with disabled (setminUpdate) prove;
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == topWaiting!;
use applyInRanPfun[TASK, QUEUE][A := TASK, B := QUEUE, f := wait\_rcv, a := topWaiting!];
apply inPower to predicate \ran  wait\_rcv \in  \power  (\dom  q\_size);
instantiate e == wait\_rcv(topWaiting!);
prove;
cases;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == e;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = TASK \setminus  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{nonexistent\} \rimg );
with enabled (distributeDiffOverCupRight) prove;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
apply extensionality to predicate \{wait\_rcv(topWaiting!)\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
prove;
split x = wait\_rcv(topWaiting!);
prove;
next;
with enabled (applyOverride) prove;
instantiate mh == running\_task;
split priority (mutex\_holder (wait\_rcv(topWaiting!))) = 0;
prove;
next;
apply extensionality to predicate (state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{running\} \rimg  = \{topReady!\};
prove;
instantiate x\_\_0 == x;
apply applyOverride to expression (state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) x;
prove;
with normalization rewrite;
next;
apply extensionality to predicate \dom  q\_max = \{wait\_rcv(topWaiting!)\} \cup  \dom  q\_size;
apply extensionality to predicate \dom  q\_max = \dom  q\_size;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
prove;
split y = wait\_rcv(topWaiting!);
prove;
next;
apply extensionality to predicate \dom  wait\_snd \cap  (\dom  wait\_rcv \setminus  \{topWaiting!\}) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate \dom  release\_snd \cap  (\{topWaiting!\} \cup  \dom  release\_rcv) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
prove;
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
instantiate x\_\_2 == x;
prove;
next;
apply inPower to predicate \ran  (\{topWaiting!\} \ndres  wait\_rcv) \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := wait\_rcv, R := \{topWaiting!\} \ndres  wait\_rcv];
prove;
next;
apply inPower to predicate \ran  (release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  release\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_1 == e;
apply oplusDef to expression release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\};
use ranSubset[TASK, QUEUE][S := release\_rcv, R := \{topWaiting!\} \ndres  release\_rcv];
prove;
with normalization rewrite;
next;
apply extensionality to predicate (\{topWaiting!\} \cup  (\dom  release\_rcv \cup  \dom  release\_snd)) \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topWaiting!\})) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_0 == x;
with normalization rewrite;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_1 == e;
with enabled (applyOverride) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == topWaiting!;
prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  (\{topWaiting!\} \cup  ((state \oplus  (\{(topWaiting!, ready)\} \cup  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topReady!, running)\}))) \inv  \limg  \{blocked\} \rimg ));
prove;
instantiate e\_\_1 == e;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topWaiting!\})) = \{\};
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  \{topWaiting!\})) = delayed\_task \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd) \setminus  \{topWaiting!\};
prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
with normalization rewrite;
next;
apply extensionality to predicate \dom  base\_priority \setminus  (state \inv  \limg  \{running\} \rimg ) = \ran  (\{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder);
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder];
apply inRan to predicate x \in  \ran  (\{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder);
apply inRan to predicate x \in  \ran  mutex\_holder;
prove;
instantiate x\_\_4 == x\_\_0;
use pairInFunction[QUEUE, TASK][f := mutex\_holder, x := wait\_rcv(topWaiting!), y := x];
prove;
cases;
prove;
next;
instantiate x\_\_1 == y;
prove;
next;
apply inPower to predicate \ran  (release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_2 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\};
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{topWaiting!\} \ndres  release\_mutex];
split e = wait\_rcv(topWaiting!);
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{wait\_rcv(topWaiting!)\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topWaiting!), 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
next;
apply inPower to predicate release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\} \in  \power  (release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
with enabled (oplusDef) prove;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate rtsk == pt;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate q\_\_0 == q;
instantiate m\_\_0 == wait\_rcv(topWaiting!);
with enabled (applyOverride) prove;
next;
instantiate t\_\_0 == t;
apply applyNdres to expression (\{topWaiting!\} \ndres  time) t;
prove;
next;
instantiate m\_\_0 == m;
with enabled (applyOverride) prove;
instantiate y == m;
prove;
next;
instantiate mh\_\_0 == mh;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder];
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
invoke transition;
with normalization rewrite;
next;
instantiate wrct == wr;
prove;
next;
instantiate rtsk == rt;
prove;
next;
\end{zproof}

\begin{theorem}{MutexGiveWInhSR\_TQTM\_vc\_ref}
\forall  MutexGiveWInhSR\_TQTMFSBSig | true @ \pre  MutexGiveWInhSR\_TQTM
\end{theorem}

\begin{zproof}[MutexGiveWInhSR\_TQTM\_vc\_ref]
use findDelegate[a := wait\_rcv \inv  \limg  \{mut?\} \rimg , g := priority];
with disabled (TaskQueueTimeMutex) prove by reduce;
split running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder);
prove;
cases;
instantiate running\_task' == topReady!, topWaiting! == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
prove;
use lMutexGiveWInhSR\_TQTM\_Lemma[topWaiting! := f (wait\_rcv \inv  \limg  \{mut?\} \rimg )];
prove;
instantiate rt\_\_0 == rtsk;
instantiate wr\_\_0 == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
instantiate t == wrct;
prove;
with normalization rewrite;
next;
instantiate running\_task\_\_0' == topReady!, topWaiting\_\_0! == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
prove;
use lMutexGiveWInhSR\_TQTM\_Lemma1[topWaiting! := f (wait\_rcv \inv  \limg  \{mut?\} \rimg )];
prove;
instantiate rt\_\_0 == rtsk;
instantiate wr\_\_0 == f (wait\_rcv \inv  \limg  \{mut?\} \rimg );
instantiate t == wrct;
prove;
with normalization rewrite;
next;
\end{zproof}

\begin{schema}{MutexGiveWInhSW\_TQTM}
  \Delta TaskQueueTimeMutex\\
  mut?: QUEUE\\
  topWaiting!: TASK
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  topWaiting! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg \\
  \forall  wr: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topWaiting!) \geq  priority(wr)\\
  \forall  rt: state \inv  \limg  \{ready\} \rimg  @ priority(topWaiting!) \geq  priority(rt)\\
  base\_priority(running\_task) \neq  priority(running\_task)\\
  priority(topWaiting!) > base\_priority(running\_task)\\
  \exists  st?: STATE; pri?: TASK \fun  \nat  | st? = ready \land  pri? = priority \oplus  \{(running\_task \mapsto  base\_priority(running\_task))\} @ Reschedule[topWaiting!/target?, tasks/tasks?]\\
  queue' = queue\\
  q\_max' = q\_max\\
  q\_size' = q\_size \oplus  \{(mut? \mapsto  1)\}\\
  wait\_snd' = wait\_snd\\
  wait\_rcv' = \{topWaiting!\} \ndres  wait\_rcv\\
  release\_snd' = release\_snd\\
  release\_rcv' = release\_rcv \oplus  \{(topWaiting! \mapsto  mut?)\}\\
  clock' = clock\\
  delayed\_task' = delayed\_task\\
  time' = \{topWaiting!\} \ndres  time\\
  time\_slice' = time\_slice\\
  semaphore' = semaphore\\
  mutex' = mutex\\
  mutex\_holder' = \{mut?\} \ndres  mutex\_holder\\
  mutex\_recursive' = mutex\_recursive \oplus  \{(mut? \mapsto  0)\}\\
  basePriorityMan\\
  release\_mutex' = release\_mutex \oplus  \{(topWaiting! \mapsto  mut?)\}
\end{schema}

\begin{zproof}[MutexGiveWInhSW\_TQTM\$domainCheck]
invoke \Delta TaskQueueTimeMutex;
invoke predicate TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{schema}{MutexGiveWInhSW\_TQTMFSBSig}
  TaskQueueTimeMutex\\
  mut?: QUEUE
\where
  running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv\\
  mut? \in  \dom  mutex\_holder\\
  running\_task = mutex\_holder(mut?)\\
  mutex\_recursive(mut?) = 1\\
  base\_priority(running\_task) \neq  priority(running\_task)\\
  \exists  topWaiting!: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ (\forall  wr: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topWaiting!) \geq  priority(wr)) \land  (\forall  rt: state \inv  \limg  \{ready\} \rimg  @ priority(topWaiting!) \geq  priority(rt)) \land  priority(topWaiting!) > base\_priority(running\_task)
\end{schema}

\begin{zproof}[MutexGiveWInhSW\_TQTMFSBSig\$domainCheck]
invoke TaskQueueTimeMutex;
invoke Mutex;
invoke MutexData;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := mut?];
prove;
\end{zproof}

\begin{theorem}{lMutexGiveWInhSW\_TQTM\_Lemma}
\forall  TaskQueueTimeMutex; topWaiting!: TASK; mut?: QUEUE | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  topWaiting! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topWaiting!) \geq  priority(wrct)) \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topWaiting!) \geq  priority(rtsk)) \land  base\_priority(running\_task) \neq  priority(running\_task) \land  priority(topWaiting!) > base\_priority(running\_task) \land  running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[log\_context := log\_context \oplus  \{(mutex\_holder (wait\_rcv(topWaiting!)), phys\_context)\}, mutex\_holder := \{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(wait\_rcv(topWaiting!), 0)\}, phys\_context := log\_context(topWaiting!), priority := priority \oplus  \{(mutex\_holder (wait\_rcv(topWaiting!)), base\_priority (mutex\_holder (wait\_rcv(topWaiting!))))\}, q\_size := q\_size \oplus  \{(wait\_rcv(topWaiting!), 1)\}, release\_mutex := release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}, release\_rcv := release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}, running\_task := topWaiting!, state := state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\}), time := \{topWaiting!\} \ndres  time, wait\_rcv := \{topWaiting!\} \ndres  wait\_rcv] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) st) \in  transition) \land  (wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = wait\_rcv(topWaiting!) \implies  priority(topWaiting!) \geq  priority(wr)) \implies  rt \in  TASK \land  state(rt) = ready \land  \lnot  priority(topWaiting!) \geq  priority(rt))
\end{theorem}

\begin{zproof}[lMutexGiveWInhSW\_TQTM\_Lemma]
with disabled (TaskData) with enabled (disjointCat) prove by reduce;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x == mut?;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := wait\_rcv(topWaiting!)];
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := mutex\_holder (wait\_rcv(topWaiting!))];
use applyInRanFun[TASK, \nat ][f := priority, a := running\_task];
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{mutex\_holder (wait\_rcv(topWaiting!))\};
prove;
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == topWaiting!;
use applyInRanPfun[TASK, QUEUE][A := TASK, B := QUEUE, f := wait\_rcv, a := topWaiting!];
apply inPower to predicate \ran  wait\_rcv \in  \power  (\dom  q\_size);
instantiate e == wait\_rcv(topWaiting!);
prove;
cases;
prove by reduce;
next;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == topWaiting!;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topWaiting!\} \cup  (\{mutex\_holder (wait\_rcv(topWaiting!))\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg )));
prove;
with normalization rewrite;
next;
apply extensionality to predicate \{wait\_rcv(topWaiting!)\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
prove;
split x = wait\_rcv(topWaiting!);
prove;
next;
with enabled (applyOverride) prove;
instantiate mh == running\_task;
split priority (mutex\_holder (wait\_rcv(topWaiting!))) = 0;
prove;
next;
apply extensionality to predicate (state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg  = \{topWaiting!\};
prove;
instantiate x\_\_0 == x;
apply applyOverride to expression (state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) x;
prove;
with normalization rewrite;
next;
apply extensionality to predicate \dom  q\_max = \{wait\_rcv(topWaiting!)\} \cup  \dom  q\_size;
apply extensionality to predicate \dom  q\_max = \dom  q\_size;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
prove;
split y = wait\_rcv(topWaiting!);
prove;
next;
apply extensionality to predicate \dom  wait\_snd \cap  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate \dom  release\_snd \cap  (((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  \dom  release\_rcv) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
prove;
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
instantiate x\_\_2 == x;
prove;
next;
apply inPower to predicate \ran  (((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \ndres  wait\_rcv) \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := wait\_rcv, R := ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \ndres  wait\_rcv];
prove;
next;
apply inPower to predicate \ran  (release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  release\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_1 == e;
apply oplusDef to expression release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\};
use ranSubset[TASK, QUEUE][S := release\_rcv, R := \{topWaiting!\} \ndres  release\_rcv];
prove;
with normalization rewrite;
next;
apply extensionality to predicate (((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  (\dom  release\_rcv \cup  \dom  release\_snd)) \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ))) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_0 == x;
with normalization rewrite;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_1 == e;
with enabled (applyOverride) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == topWaiting!;
prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  (((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{blocked\} \rimg ) \cup  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ));
prove;
instantiate e\_\_1 == e;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ))) = \{\};
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ))) = delayed\_task \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd) \setminus  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg );
prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
prove;
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == x;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_1 == x;
apply applyOverride to expression (state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) x;
prove;
with normalization rewrite;
next;
use ranUnchanged[QUEUE, TASK][f := mutex\_holder, a := mut?];
prove;
next;
apply inPower to predicate \ran  (release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_2 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\};
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{topWaiting!\} \ndres  release\_mutex];
split e = wait\_rcv(topWaiting!);
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{wait\_rcv(topWaiting!)\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topWaiting!), 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
next;
apply inPower to predicate release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\} \in  \power  (release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
with enabled (oplusDef) prove;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate rtsk == pt;
with enabled (applyOverride) prove;
next;
instantiate q\_\_0 == q;
instantiate m\_\_0 == wait\_rcv(topWaiting!);
with enabled (applyOverride) prove;
next;
instantiate t\_\_0 == t;
apply applyNdres to expression (((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \ndres  time) t;
prove;
next;
instantiate m\_\_0 == m;
with enabled (applyOverride) prove;
instantiate y == m;
prove;
next;
instantiate mh\_\_0 == mh;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder];
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
invoke transition;
prove;
next;
instantiate wrct == wr;
prove;
next;
instantiate rtsk == rt;
prove;
next;
\end{zproof}

\begin{theorem}{lMutexGiveWInhSW\_TQTM\_Lemma1}
\forall  TaskQueueTimeMutex; topWaiting!: TASK; mut?: QUEUE | running\_task \notin  \dom  release\_snd \cup  \dom  release\_rcv \land  mut? \in  \dom  mutex\_holder \land  running\_task = mutex\_holder(mut?) \land  mutex\_recursive(mut?) = 1 \land  topWaiting! \in  wait\_rcv \inv  \limg  \{mut?\} \rimg  \land  (\forall  wrct: wait\_rcv \inv  \limg  \{mut?\} \rimg  @ priority(topWaiting!) \geq  priority(wrct)) \land  (\forall  rtsk: state \inv  \limg  \{ready\} \rimg  @ priority(topWaiting!) \geq  priority(rtsk)) \land  base\_priority(running\_task) \neq  priority(running\_task) \land  priority(topWaiting!) > base\_priority(running\_task) \land  running\_task \notin  \ran  (\{mut?\} \ndres  mutex\_holder) @ \lnot  (TaskQueueTimeMutex[base\_priority := \{mutex\_holder (wait\_rcv(topWaiting!))\} \ndres  base\_priority, log\_context := log\_context \oplus  \{(mutex\_holder (wait\_rcv(topWaiting!)), phys\_context)\}, mutex\_holder := \{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder, mutex\_recursive := mutex\_recursive \oplus  \{(wait\_rcv(topWaiting!), 0)\}, phys\_context := log\_context(topWaiting!), priority := priority \oplus  \{(mutex\_holder (wait\_rcv(topWaiting!)), base\_priority (mutex\_holder (wait\_rcv(topWaiting!))))\}, q\_size := q\_size \oplus  \{(wait\_rcv(topWaiting!), 1)\}, release\_mutex := release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}, release\_rcv := release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}, running\_task := topWaiting!, state := state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\}), time := \{topWaiting!\} \ndres  time, wait\_rcv := \{topWaiting!\} \ndres  wait\_rcv] \land  (st \in  TASK \land  \lnot  (state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) st = state(st) \implies  (state(st), (state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) st) \in  transition) \land  (wr \in  \dom  wait\_rcv \land  wait\_rcv(wr) = wait\_rcv(topWaiting!) \implies  priority(topWaiting!) \geq  priority(wr)) \implies  rt \in  TASK \land  state(rt) = ready \land  \lnot  priority(topWaiting!) \geq  priority(rt))
\end{theorem}

\begin{zproof}[lMutexGiveWInhSW\_TQTM\_Lemma1]
with disabled (TaskData) with enabled (disjointCat) prove by reduce;
apply extensionality to predicate \dom  mutex\_holder = \{  f: \dom  mutex\_recursive | q\_size(f) = 0 \};
instantiate x == mut?;
use applyInRanPfun[QUEUE, TASK][A := QUEUE, B := TASK, f := mutex\_holder, a := wait\_rcv(topWaiting!)];
use applyInRanPfun[TASK, \num ][A := TASK, B := \nat , f := base\_priority, a := mutex\_holder (wait\_rcv(topWaiting!))];
use applyInRanFun[TASK, \nat ][f := priority, a := running\_task];
apply extensionality to predicate state \inv  \limg  \{running\} \rimg  = \{mutex\_holder (wait\_rcv(topWaiting!))\};
prove;
apply inPower to predicate \dom  wait\_rcv \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == topWaiting!;
use applyInRanPfun[TASK, QUEUE][A := TASK, B := QUEUE, f := wait\_rcv, a := topWaiting!];
apply inPower to predicate \ran  wait\_rcv \in  \power  (\dom  q\_size);
instantiate e == wait\_rcv(topWaiting!);
prove;
cases;
prove by reduce;
next;
apply inPower to predicate delayed\_task \in  \power  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_0 == e;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == topWaiting!;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg ) = \{topWaiting!\} \cup  (\{mutex\_holder (wait\_rcv(topWaiting!))\} \cup  (TASK \setminus  (state \inv  \limg  \{nonexistent\} \rimg )));
prove;
with normalization rewrite;
next;
apply extensionality to predicate \{wait\_rcv(topWaiting!)\} \cup  \dom  mutex\_recursive = \dom  mutex\_recursive;
prove;
split x = wait\_rcv(topWaiting!);
prove;
next;
with enabled (applyOverride) prove;
instantiate mh == running\_task;
split priority (mutex\_holder (wait\_rcv(topWaiting!))) = 0;
prove;
next;
apply extensionality to predicate (state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg  = \{topWaiting!\};
prove;
instantiate x\_\_0 == x;
apply applyOverride to expression (state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) x;
prove;
with normalization rewrite;
next;
apply extensionality to predicate \dom  q\_max = \{wait\_rcv(topWaiting!)\} \cup  \dom  q\_size;
apply extensionality to predicate \dom  q\_max = \dom  q\_size;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
prove;
split y = wait\_rcv(topWaiting!);
prove;
next;
apply extensionality to predicate \dom  wait\_snd \cap  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg )) = \{\};
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate \dom  release\_snd \cap  (((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  \dom  release\_rcv) = \{\};
apply extensionality to predicate \dom  release\_rcv \cap  \dom  release\_snd = \{\};
prove;
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_0 == x;
instantiate x\_\_1 == x;
instantiate x\_\_2 == x;
prove;
next;
apply inPower to predicate \ran  (((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \ndres  wait\_rcv) \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_0 == e;
use ranSubset[TASK, QUEUE][S := wait\_rcv, R := ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \ndres  wait\_rcv];
prove;
next;
apply inPower to predicate \ran  (release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}) \in  \power  (\dom  q\_size);
apply inPower to predicate \ran  release\_rcv \in  \power  (\dom  q\_size);
prove;
instantiate e\_\_1 == e;
apply oplusDef to expression release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\};
use ranSubset[TASK, QUEUE][S := release\_rcv, R := \{topWaiting!\} \ndres  release\_rcv];
prove;
with normalization rewrite;
next;
apply extensionality to predicate (((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \cup  (\dom  release\_rcv \cup  \dom  release\_snd)) \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ))) = \{\};
apply extensionality to predicate (\dom  release\_rcv \cup  \dom  release\_snd) \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_0 == x;
with normalization rewrite;
next;
apply inPower to predicate \dom  wait\_snd \in  \power  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{blocked\} \rimg );
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
prove;
instantiate e\_\_1 == e;
with enabled (applyOverride) prove;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_0 == topWaiting!;
prove;
next;
apply inPower to predicate \dom  wait\_rcv \in  \power  (((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{blocked\} \rimg ) \cup  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ));
prove;
instantiate e\_\_1 == e;
with enabled (applyOverride) prove;
next;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ))) = \{\};
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
prove;
instantiate x\_\_1 == x;
prove;
next;
apply extensionality to predicate delayed\_task \cup  (\dom  wait\_snd \cup  (\dom  wait\_rcv \setminus  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ))) = delayed\_task \cup  (\dom  wait\_rcv \cup  \dom  wait\_snd) \setminus  ((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg );
prove;
apply extensionality to predicate delayed\_task \cap  (\dom  wait\_rcv \cup  \dom  wait\_snd) = \{\};
instantiate x\_\_1 == x;
apply extensionality to predicate \dom  wait\_rcv \cap  \dom  wait\_snd = \{\};
instantiate x\_\_1 == x;
prove;
apply inPower to predicate delayed\_task \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e == x;
apply inPower to predicate \dom  wait\_snd \in  \power  (state \inv  \limg  \{blocked\} \rimg );
instantiate e\_\_1 == x;
apply applyOverride to expression (state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) x;
prove;
with normalization rewrite;
next;
apply extensionality to predicate \dom  base\_priority \setminus  (state \inv  \limg  \{running\} \rimg ) = \ran  (\{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder);
apply extensionality to predicate \dom  base\_priority = \ran  mutex\_holder;
prove;
instantiate x\_\_1 == x;
instantiate y\_\_0 == y;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder];
apply inRan to predicate x \in  \ran  (\{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder);
apply inRan to predicate x \in  \ran  mutex\_holder;
prove;
instantiate x\_\_4 == x\_\_0;
use pairInFunction[QUEUE, TASK][f := mutex\_holder, x := wait\_rcv(topWaiting!), y := x];
prove;
cases;
prove;
next;
instantiate x\_\_1 == y;
prove;
next;
apply inPower to predicate \ran  (release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\}) \in  \power  (\dom  mutex\_recursive);
apply inPower to predicate \ran  release\_mutex \in  \power  (\dom  mutex\_recursive);
prove;
instantiate e\_\_2 == e;
apply oplusDef to expression release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\};
use ranSubset[TASK, QUEUE][S := release\_mutex, R := \{topWaiting!\} \ndres  release\_mutex];
split e = wait\_rcv(topWaiting!);
prove;
next;
apply extensionality to predicate \{  f\_\_0: \dom  mutex\_recursive | q\_size(f\_\_0) = 0 \} \setminus  \{wait\_rcv(topWaiting!)\} = \{  f\_\_1: \dom  mutex\_recursive | (q\_size \oplus  \{(wait\_rcv(topWaiting!), 1)\}) f\_\_1 = 0 \};
with enabled (applyOverride) prove;
next;
apply inPower to predicate release\_mutex \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\} \in  \power  (release\_rcv \oplus  \{(topWaiting!, wait\_rcv(topWaiting!))\});
apply inPower to predicate release\_mutex \in  \power  release\_rcv;
prove;
instantiate e\_\_0 == e;
with enabled (oplusDef) prove;
next;
with enabled (applyOverride) prove;
with normalization rewrite;
next;
instantiate rtsk == pt;
with enabled (applyOverride) prove;
next;
instantiate q\_\_0 == q;
instantiate m\_\_0 == wait\_rcv(topWaiting!);
with enabled (applyOverride) prove;
next;
instantiate t\_\_0 == t;
apply applyNdres to expression (((state \oplus  (\{(mutex\_holder (wait\_rcv(topWaiting!)), ready)\} \cup  \{(topWaiting!, running)\})) \inv  \limg  \{running\} \rimg ) \ndres  time) t;
prove;
next;
instantiate m\_\_0 == m;
with enabled (applyOverride) prove;
instantiate y == m;
prove;
next;
instantiate mh\_\_0 == mh;
use ranSubset[QUEUE, TASK][S := mutex\_holder, R := \{wait\_rcv(topWaiting!)\} \ndres  mutex\_holder];
with enabled (applyOverride) prove;
next;
with enabled (applyOverride) prove;
invoke transition;
prove;
next;
instantiate wrct == wr;
prove;
next;
instantiate rtsk == rt;
prove;
next;
\end{zproof}

\begin{theorem}{MutexGiveWInhSW\_TQTM\_vc\_ref}
\forall  MutexGiveWInhSW\_TQTMFSBSig | true @ \pre  MutexGiveWInhSW\_TQTM
\end{theorem}

\begin{zproof}[MutexGiveWInhSW\_TQTM\_vc\_ref]
with disabled (TaskQueueTimeMutex) prove by reduce;
split running\_task \in  \ran  (\{mut?\} \ndres  mutex\_holder);
prove;
cases;
instantiate running\_task' == topWaiting!;
prove;
use lMutexGiveWInhSW\_TQTM\_Lemma;
prove;
instantiate wr\_\_0 == wrct;
instantiate rt\_\_0 == rtsk;
prove;
with normalization rewrite;
next;
instantiate running\_task\_\_0' == topWaiting!;
prove;
use lMutexGiveWInhSW\_TQTM\_Lemma1;
prove;
instantiate wr\_\_0 == wrct;
instantiate rt\_\_0 == rtsk;
prove;
with normalization rewrite;
next;
\end{zproof}


\end{document}